As we are removing crosscheck between sso configuration of authorizationGenerators and roles and groups defined in magnolia we are removing nested groups/roles defined in magnolia/jcr for SsoUser at same time. Only roles and groups assigned to such user are configured in sso configuration file. This file with mapping and sso provider (e.g. okta) are one and only source of then now.