Application B — Claim-based gate

MidPoint methodology: entitlements are provisioned into the IdP pipeline. This app never calls MidPoint. Access is granted when OIDC membership claims intersect the configured allow-list.

Required entitlements for this application (from OIDC_ALLOWED_GROUPS):

• midpoint-demo

Membership claims inspected: edumember_is_member_of, eduperson_entitlement, groups.