[Integrate-1693] query groups via Graph API, use env for required claim

[suwarnoong]

Merge Checklist

Please cross check this list if additions / modifications needs to be done on top of your core changes and tick them off. Reviewer can as well glance through and help the developer if something is missed out.

• Automated Tests (Jasmine integration tests, Unit tests, and/or Performance tests)
• Updated Manual tests / Demo Config
• Documentation (Application guide, Admin guide, Markdown, Readme and/or Wiki)
• Verified that local development environment is working with latest changes (integrated with latest develop branch)
• following best practices in code review doc

[Copilot]

Pull request overview

This pull request implements two main changes: (1) migrates from reading Azure AD group memberships from token claims to querying them via the Microsoft Graph API, and (2) makes the required claim name for OIDC tokens configurable via an environment variable instead of being hardcoded.

Changes:

• Added configurable IDP_REQUIRED_CLAIM environment variable to make the required token claim name flexible
• Implemented Graph API integration to fetch user groups via the /me/memberOf endpoint instead of relying on groups claim in tokens
• Added configurable scopes field to Azure AD connector configuration

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
ui/apps/portal/src/containers/auth/oidc/OidcApp.tsx	Updates OIDC token validation to use configurable required claim name from environment variable
services/trex/core/server/routes/portal.ts	Passes IDP_REQUIRED_CLAIM environment variable to frontend
services/trex/core/server/env.ts	Adds IDP_REQUIRED_CLAIM to server environment configuration
services/alp-logto/connector-alp-azuread/src/types.ts	Adds optional scopes field to Azure AD connector configuration schema
services/alp-logto/connector-alp-azuread/src/index.ts	Implements getUserGroups function to query Graph API, adds parseScopes utility, and updates token exchange error handling
services/alp-logto/connector-alp-azuread/src/constant.ts	Renames scopes constant to defaultScopes, adds Graph API memberOf endpoint, and adds scopes configuration field
docker-compose.yml	Sets default value for IDP_REQUIRED_CLAIM and updates example connector configuration comment

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.