[FR] Auto provisioning of user based on a claim

[T0mWz]

For the Dutch Sync-And-Share service, we requires an specific OpenID Connect claim on which basis we do auto provisioning of a user. See also; https://wiki.surfnet.nl/display/surfconextdev/Attributes+in+SURFconext#AttributesinSURFconext-eduPersonEntitlementEntitlements

Example result what we could receive from an IdP.

{
\"acr\":\"urn:oasis:names:tc:SAML:2.0:ac:classes:Password\",
\"eduperson_entitlement\":[ \"blabla\" ],
\"eduperson_principal_name\":\"john.doe\", // username
\"email\":\"[email protected]\",
\"email_verified\":true,
\"family_name\":\"Doe\",
\"given_name\":\"John\",
\"name\":\"John Doe\",
\"sub\":\"14d2e30500462aa3499e165ade96d47edaded978\",
\"updated_at\":1618577357
}

This would require a check for a specific claim with corresponding value in the OpenID Connect app.

  'openid-connect' => [
    ..
    ..
    'auto-provision' => [
      ...
      'provisioning-claim' => 'eduperson_entitlement',
      'provisioning-attribute' => 'blabla',

    ]
  ],