diff --git a/internal/dao/common.go b/internal/dao/common.go
index e20e8f7..e3b6597 100644
--- a/internal/dao/common.go
+++ b/internal/dao/common.go
@@ -244,8 +244,7 @@ func ListFiltered(ctx context.Context, db bun.IDB,
 	if organizationId.Valid {
 		sq = sq.Where("organization_id = ?", organizationId)
 	}
-	//TODO: to be uncommented after fixing the test case
-	//sq = sq.Where("trash = ?", false)
+	sq = sq.Where("trash = ?", false)
 	if orderBy != "" && order != "" {
 		sq.Order(orderBy + " " + order)
 	}
diff --git a/main.go b/main.go
index cab7ff4..04a5728 100644
--- a/main.go
+++ b/main.go
@@ -122,6 +122,7 @@ var (
 	coreCDRelayUserHost      string
 	coreCDRelayConnectorHost string
 	schedulerNamespace       string
+	sentryBootstrapAddr      string
 
 	// kratos
 	kratosAddr       string
@@ -255,6 +256,7 @@ func setup() {
 	coreCDRelayUserHost = viper.GetString(coreCDRelayUserHostEnv)
 	relayImage = viper.GetString(relayImageEnv)
 	schedulerNamespace = viper.GetString(schedulerNamespaceEnv)
+	sentryBootstrapAddr = viper.GetString(sentryBootstrapEnv)
 
 	auditFile = viper.GetString(auditFileEnv)
 	elasticSearchUrl = viper.GetString(esEndPointEnv)
@@ -335,7 +337,7 @@ func setup() {
 	rs = service.NewRoleService(db, as, auditLogger)
 	rrs = service.NewRolepermissionService(db)
 	is = service.NewIdpService(db, apiAddr, auditLogger)
-	oidcs = service.NewOIDCProviderService(db, kratosAddr, auditLogger)
+	oidcs = service.NewOIDCProviderService(db, sentryBootstrapAddr, auditLogger)
 
 	//sentry related services
 	bs = service.NewBootstrapService(db)
diff --git a/pkg/service/group_test.go b/pkg/service/group_test.go
index 3850945..d34538b 100644
--- a/pkg/service/group_test.go
+++ b/pkg/service/group_test.go
@@ -608,7 +608,7 @@ func TestGroupListFiltered(t *testing.T) {
 	pruuid := uuid.New().String()
 
 	puuid, ouuid := addOrgParterFetchExpectation(mock)
-	mock.ExpectQuery(`SELECT "group"."id", "group"."name", .*WHERE .name ILIKE '%filter-query%'. AND .partner_id = '` + puuid + `'. AND .organization_id = '` + ouuid + `'. ORDER BY "email" asc LIMIT 50 OFFSET 20`).
+	mock.ExpectQuery(`SELECT "group"."id", "group"."name", .*WHERE .name ILIKE '%filter-query%'. AND .partner_id = '` + puuid + `'. AND .organization_id = '` + ouuid + `'. AND .trash = FALSE. ORDER BY "email" asc LIMIT 50 OFFSET 20`).
 		WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "name"}).
 		AddRow(guuid1, "group-"+guuid1).AddRow(guuid2, "group-"+guuid2))
 
diff --git a/pkg/service/oidc_provider.go b/pkg/service/oidc_provider.go
index d01b9f1..2b8278a 100644
--- a/pkg/service/oidc_provider.go
+++ b/pkg/service/oidc_provider.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"net"
 	"net/url"
 	"time"
 
@@ -40,8 +41,14 @@ func NewOIDCProviderService(db *bun.DB, kratosUrl string, al *zap.Logger) OIDCPr
 }
 
 func generateCallbackUrl(id string, kUrl string) string {
-	b, _ := url.Parse(kUrl)
-	return fmt.Sprintf("%s://%s/self-service/methods/oidc/callback/%s", b.Scheme, b.Host, id)
+	scheme := "http"
+	host, port, err := net.SplitHostPort(kUrl)
+	if err == nil {
+		if port == "443" {
+			scheme = "https"
+		}
+	}
+	return fmt.Sprintf("%s://%s/self-service/methods/oidc/callback/%s", scheme, host, id)
 }
 
 func validateURL(rawURL string) error {
@@ -343,6 +350,7 @@ func (s *oidcProvider) Update(ctx context.Context, provider *systemv3.OIDCProvid
 		MapperURL:       mapUrl,
 		MapperFilename:  provider.Spec.GetMapperFilename(),
 		ClientId:        provider.Spec.GetClientId(),
+		ClientSecret:    existingP.ClientSecret,
 		Scopes:          provider.Spec.GetScopes(),
 		IssuerURL:       issUrl,
 		AuthURL:         authUrl,
diff --git a/scripts/initialize/permissions/base/oidc_write.json b/scripts/initialize/permissions/base/oidc_write.json
index 72ebd5a..e70e5c0 100644
--- a/scripts/initialize/permissions/base/oidc_write.json
+++ b/scripts/initialize/permissions/base/oidc_write.json
@@ -1,6 +1,6 @@
 {
   "name": "oidc.write",
-  "base_url": "/auth/v3/sso/auth/v3/sso/oidc/provider",
+  "base_url": "/auth/v3/sso/oidc/provider",
   "description": "create, manage oidc configuration.",
   "resource_urls": [
     {