You should be able to set ACL for non-existing groups using this syntax: set ACL for "my-group;my-idp" (ACLOptions=ignoreMissingPrincipal) allow jcr:read on /content/wknd/us/en/magazine end

Hi @Psythe  SlingUserInfoProcessor has a lot of dependencies that are embedded in the oidc granite bundle. If you want to modify it, you need to include all of them. You can find the list in the sling project.   I suggest instead to implement the org.apache.sling.auth.oauth_client.spi.UserInfoProces...