OAuth 2: support for scope aliases (mappings)

[michaelklishin]

In some environments, producing scopes that follow the convention used by our OAuth 2 authN/authZ backend is effectively impossible for non-technical reasons.

@MarcialRosales has suggested a workaround that would allow for a mapping of scopes to a set of
RabbitMQ permission scopes.

Here is an example:

{rabbitmq_auth_backend_oauth2, [
    {resource_server_id, <<"rabbitmq-122">>},
    {extra_scopes_source, <<"claims">>},
    {scope_aliases, #{
      <<"megacorp.roles.122">>      => [
        <<"rabbitmq.read:vhost-122/*">>,
        <<"rabbitmq.write:vhost-122/*">>,
        <<"rabbitmq.configure:vhost-122/*">>
      ],
      <<"megacorp.roles.188">>     => [
        <<"rabbitmq.read:vhost-188/*">>,
        <<"rabbitmq.configure:vhost-188/*">>
       ],
      <<"megacorp.roles.199">>      => [<<"rabbitmq.read:*/*">>]
    }}
    {key_config, [

{

  "claims": "megacorp.roles.122",
  "aud": [
    "rabbitmq-122"
  ]
}

The rabbitmq_auth_backend_oauth2.scope_mappings key, if defined, can be used to look up
a set of RabbitMQ permissions that would then be parsed just like "regular" JWT token scopes
are.

[michaelklishin]

We decided to extend this to support multiple aliases per scope list (or another field used for extra_scopes_source).