mod_auth_openidc multi-value claim array with spaces

[dominar250]

I need to allow users based on the memberOf attribute group in the apache application using mod_auth_openidc
after decrypting my token this is what I received :

{
  "scope": [
    "openid",
    "profile",
    "email"
  ],
  "client_id": "SECRTEKEY",
  "firstName": "myname",
  "lastName": "lastname",
  "emailAddress": "myname.lastname@examole.com",
  "memberOf": [
    "CN=Sophos client,OU=ABCD-EF Environments,OU=SecurityGroups,DC=example,DC=com",
    "CN=forti client,OU=ABCD-EF Environments,OU=SecurityGroups,DC=example,DC=com",
    "CN=juniper client,OU=ABCD-EF Environments,OU=SecurityGroups,DC=example,DC=com",  
],
  "userType": "Employee",
  "userId": "K909090",
  "username": "K909090",
  "exp": 1985724088
}

my config file is

   OIDCProviderMetadataURL url.well-known/openid-configuration
   OIDCScope "openid profile email"
   OIDCClientID SECRET
   OIDCClientSecret SECRET
   OIDCRedirectURI redirecturl
   OIDCCryptoPassphrase <password>
   OIDCSSLValidateServer Off
   OIDCRemoteUserClaim email
  
   <Location />
     AuthType openid-connect
     #Require valid-user
   Require claim memberOf:CN=Sophos client,OU=ABCD-EF Environments,OU=SecurityGroups,DC=example,DC=com
   </Location>

but it is not working for me , it says mod_authz_core.c denied

[zandbelt]

use quotes around the value to accommodate for the spaces in there:

Require claim "memberOf:CN=Sophos client,OU=ABCD-EF Environments,OU=SecurityGroups,DC=example,DC=com"

and if it does not work, set LogLevel auth_openidc:debug and check the log files to see why it fails to match