diff --git a/plugins/auth-node/src/IdentityClient.test.ts b/plugins/auth-node/src/IdentityClient.test.ts
index 9cdd9a81a6..b452c3f81d 100644
--- a/plugins/auth-node/src/IdentityClient.test.ts
+++ b/plugins/auth-node/src/IdentityClient.test.ts
@@ -143,6 +143,21 @@ describe('IdentityClient', () => {
       });
     });
 
+    it('should decode claims correctly', async () => {
+      const token = await factory.issueToken({
+        claims: { sub: 'foo', ent: ['entity1', 'entity2'] },
+      });
+      const response = await client.authenticate(token);
+      expect(response).toEqual({
+        token: token,
+        identity: {
+          type: 'user',
+          userEntityRef: 'foo',
+          ownershipEntityRefs: ['entity1', 'entity2'],
+        },
+      });
+    });
+
     it('should throw on incorrect issuer', async () => {
       const hackerFactory = new FakeTokenFactory({
         issuer: 'hacker',
diff --git a/plugins/auth-node/src/IdentityClient.ts b/plugins/auth-node/src/IdentityClient.ts
index 2fdb876dd6..c0eba6a069 100644
--- a/plugins/auth-node/src/IdentityClient.ts
+++ b/plugins/auth-node/src/IdentityClient.ts
@@ -95,7 +95,7 @@ export class IdentityClient {
         type: 'user',
         userEntityRef: decoded.payload.sub,
         ownershipEntityRefs: decoded.payload.ent
-          ? [decoded.payload.ent as string]
+          ? (decoded.payload.ent as string[])
           : [],
       },
     };