I am doing a POC work on OIDC SSO authentication using Google. I have hardcoded a model operator(Access group is HRApps:User) in the authentication service rule and its working fine. As I am using free Google as Idp, it only sends standard claims like name, email etc. and does not have provision to get claims for user role, access group etc.

However my requirement is that if I login with Proprietary information hidden then Access Group mapped should be "HRApps:User" and if I login with Proprietary information hidden then Access Group mapped should be "HRApps:Manager".

I have tried couple of options like Data Page and Data transform for setting model operator and also tried below option but still its not working. 

https://docs.pega.com/bundle/platform/page/platform/security/dynamicall…

Please help me with the solution. Code snippet would be really helpful.