When no claim mapping rules are configured or none match the JWT claims, fall back to assigning the OidcConfig.defaultRoles (e.g. VIEWER). This restores the behavior that was lost when syncOidcRoles was replaced with claim mapping. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>