OIDC _can_ have group memberships if the provider/client support it via claims. LDAP is a pain because you have to expose/support a lot of knobs for integratio

OIDC _can_ have group memberships if the provider/client support it via claims. LDAP is a pain because you have to expose/support a lot of knobs for integration (bind vs anonymous, secure vs unsecure, group format, root DNs, etc.). OIDC is (in theory) a lot simpler for the most part as the bare minimum is discovery URL, client ID, and client secret.