One oauth2-proxy sits in front of the portal. Pick the Cognito app client that issued your identity; the broker will mint a token with teams and groups.
Login with BMW Login with Volvo