Unauthorized error with oauth2-proxy´s allow-group flag

Question

I am using oauth2 to handle the authentication/authorization via a company´s SSO provider of a web app running in k8. The authentication works like a charm, however, once enable authorization for a specific group ( here: "ADMIN"), I always get a 403 - Forbidden "Invalid session: unauthorized" error.

Version: quay.io/oauth2-proxy/oauth2-proxy:v7.3.0

SSO Provider: oidc

My setup:

extraArgs:
  show-debug-on-error: True
  oidc-groups-claim: "ent_group"
  allowed-group: ["ADMIN"]
  oidc-email-claim: "email"
  scope: "openid ent_group"
  whitelist-domain: ...
  cookie-domain: ...

It matches the response from the SSO provider when tested with Postman:

{
    "email": "[email protected]",
    "entitlement_group": [
        "ADMIN",
        "USER"
    ],
    "app_id": "app"
}

What do I do wrong?