Close OpenBao OIDC admin bootstrap path

sso-mfa/k8s/keycape/configure-openbao-oidc.sh

@@ -42,6 +42,9 @@ OPENBAO_POD="${OPENBAO_POD:-openbao-0}"
     oidc_client_secret="keycape-public-pkce-compatibility-value" \
     default_role="platform-admin"
 
+  # Keep array-valued groups in groups_claim/bound_claims only. OpenBao
+  # claim_mappings copy scalar claim values into metadata and will fail if the
+  # groups array is mapped there.
   cat >/tmp/openbao-platform-admin-role.json <<'"'"'ROLE_JSON'"'"'
 {
   "role_type": "oidc",
@@ -57,8 +60,7 @@ OPENBAO_POD="${OPENBAO_POD:-openbao-0}"
   },
   "claim_mappings": {
     "email": "email",
-    "preferred_username": "username",
-    "groups": "groups"
+    "preferred_username": "username"
   },
   "policies": ["platform-admin"],
   "ttl": "1h"