accessToken is not checked for configured roles in OIDC flow, only idToken is checked (Okta)

[emerfan]

We are using Okta for our OIDC flow. A user's roles are returned as part of the accessToken in a field 'role'. I have debugged, AKHQ does not check the accessToken for roles, only the idToken.

I cannot see a configuration to enable this. My configuration is as follows:

micronaut:
  security:
    enabled: true
    oauth2:
      enabled: true
      clients:
        okta:
          scopes:
            - openid
            - profile
            - roles
          client-id: "myid"
          client-secret: "mysecret"
          openid:
            issuer: https://myokta/oauth2/default
#            configuration-path: "/.well-known/openid-configuration"
          configuration-path: "/.well-known/jwks.json"
akhq:
  connections:
    dps:
      properties:
        bootstrap.servers: ""
        security.protocol: SASL_SSL
        sasl.mechanism: PLAIN
        sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="" password="";
  security:
    roles:
      topic-read:
        - resources: [ "TOPIC", "TOPIC_DATA" ]
          actions: [ "READ" ]
        - resources: [ "TOPIC" ]
          actions: [ "READ_CONFIG" ]
        - resources: [ "CONSUMER_GROUP" ]
          actions: [ "READ" ]
      topic-read-pii:
        - resources: [ "TOPIC", "TOPIC_DATA" ]
          actions: [ "READ", "READ-PHI" ]
        - resources: [ "TOPIC" ]
          actions: [ "READ_CONFIG" ]
        - resources: [ "CONSUMER_GROUP" ]
          actions: [ "READ" ]
    # Groups definition
    groups:
      topic-reader:
        - role: topic-read
      topic-reader-pii:
        - role: topic-read-phi
    default-group: no-roles
    oidc:
      enabled: true
      providers:
        okta:
          label: Log in with Okta
          username-field: email
          groups-field: role
          default-group: topic-reader
          groups:
            - name: akhq:reader
              groups:
                # the corresponding akhq groups (eg. topic-reader/writer or akhq default groups like admin/reader/no-role)
                - topic-reader-pii