Invalid URL error - Group Parsing

Request Type

Bug

Work Environment

Problem Description

Invalid URL error when attempting to use Group Mapper for OAUTH.
Cortex mandates the use of Groups URL as per https://github.com/TheHive-Project/Cortex/blob/619b28a3cd2b9a46bb553baf1b647b25405620df/app/org/thp/cortex/services/mappers/GroupUserMapper.scala while the same info can be fetched from User URL

This seems to be the same error that was originally identified for TheHive by ananth07reddy in https://github.com/TheHive-Project/TheHive/issues/1010
It was consequently fixed in https://github.com/TheHive-Project/TheHive/pull/1112 but never in Cortex.

Steps to Reproduce

1. Setup OIDC/OAUTH2 config for Cortex with SSO mapper set to group as per https://github.com/TheHive-Project/CortexDocs/blob/master/admin/admin-guide.md#oauth2openid-connect
2. Don't provide the Groups URL as group information needs to be fetched from User URL.
3. Attempt to SSO login from the front end and observe logs for Invalid URL

Possible Solutions

Maybe port the solution from theHive https://github.com/TheHive-Project/TheHive/pull/1112 to Cortex

Complementary information

[error] o.e.s.a.MultiAuthSrv - Authentication failure
org.elastic4play.AuthenticationError: OAuth2 authentication failure: Invalid URL 
	at org.thp.cortex.services.OAuth2Srv$$anonfun$$nestedInanonfun$authenticate$1$1.applyOrElse(OAuth2Srv.scala:96)
	at org.thp.cortex.services.OAuth2Srv$$anonfun$$nestedInanonfun$authenticate$1$1.applyOrElse(OAuth2Srv.scala:95)
	at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:417)
	at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:41)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:56)
	at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:93)
	at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:85)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:93)

Start with app/org/thp/cortex/services/mappers/GroupUserMapper.scala and the failure location in OAuth2Srv.scala:96. Compare Cortex's group mapping with TheHive pull request 1112, referenced by the issue, and verify the group mapper can authenticate when group information is obtained from the User URL without a Groups URL. No test file is named in the issue.