SAML IdP attribute mapping types and config handler

[flyinghermit]

Supports attribute mapping configuration in saml_idp_service_provider spec.

 attribute_mapping:
  - name: string
    name_format: string
    value: string # predicate expression

value of name_format can be one of the following:

• unspecified or urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified. Used as a default value.
• uri or urn:oasis:names:tc:SAML:2.0:attrname-format:uri.
• basic or urn:oasis:names:tc:SAML:2.0:attrname-format:basic.

Reference spec file:

sp.yml
kind: saml_idp_service_provider
metadata:
  name: sp
  revision: 54eec4e0-1483-4b3e-807f-8421abd331de
spec:
  attribute_mapping:
  - name: displayname
    value: user.spec.traits.firstname
  - name: email
     name_format: urn
     value: user.spec.traits.email
  - name: firstname
    name_format: urn:oasis:names:tc:SAML:2.0:attrname-format:basic
    value: user.spec.traits.firstname
  entity_descriptor: |-
    <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2023-12-10T16:26:51.083Z" entityID="https://example.com/saml/metadata">
      <SPSSODescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" validUntil="2023-12-10T16:26:51.083029Z" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="false" WantAssertionsSigned="true">
        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://example.com/saml/acs" index="1"></AssertionConsumerService>
        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://example.com/saml/acs" index="2"></AssertionConsumerService>
      </SPSSODescriptor>
    </EntityDescriptor>
  entity_id: https://example.com/saml/metadata
version: v1

RFD: https://github.com/gravitational/teleport.e/pull/2801
see #34725, https://github.com/gravitational/teleport.e/issues/2692

changelog: attribute mapping in saml_idp_service_provider spec.

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[flyinghermit]

Friendly ping

[r0mant]

A few stylistic nitpicks.

[flyinghermit]

Friendly ping @xacrimon @fspmarshall @mdwn

[public-teleport-github-review-bot]

@flyinghermit See the table below for backport results.

Branch	Result
branch/v14	Failed