SSO: support non-toplevel attribute_requirements

[smoehrle]

Description:

To the best of my knowledge, it is only possible to configure and check attribute requirements if the attribute is in the toplevel of the claim/access token.

Example
We use keycloak as OIDC provider. The access token of keycloak contains:

  "resource_access": {
    "{client-id}": {
      "roles": [
        "{client-role-1}",
        "{client-role-2}",
      ]
    }
  },

I want to allow authentication based on a assigned client-role which is nested inside multiple objects.

Possible solution
A solution could be to allow dot-notation for the attribute requiremtes to access nested elements

# homeserver.yaml
    oidc_providers:
    - idp_id: keycloak
      {...}
      attribute_requirements:
        - attribute: resource_access.{client-id}.roles
          value: {client-role-1}

[Galbar]

I have the same problem with nextcloud, where the groups are at ocs.data.groups. A possible solution would be to allow for a jinja template, like with other attributes.

[Galbar]

I managed by setting it like this:

• enable_registration: false
• localpart_template: "{% if '{client-role-1}' in user.ocs.data.groups %}{{ user.ocs.data.id }}{% endif %}"

It's not pretty but it does the job 🤷