chfkch 
Ah, you got to love that sometimes SSO callback URIs have a trailing slash and sometimes they don't. And no, i did absolutely not search for the error 45 minutes straight.
By the way, did anybody set up claimMaps for kanidm in NixOS yet? I am too sleepy right now and i think i am reading it wrong.
https://search.nixos.org/options?channel=25.11&query=services.kanidm&show=services.kanidm.provision.systems.oauth2.<name>.claimMaps.<name>.valuesByGroup