add scope and authparam flags and parameters for OIDC

Author: jdoupe

command/ca/provisioner/provisioner.go

@@ -605,6 +605,16 @@ Use the '--group' flag multiple times to configure multiple groups.`,
 		Name:  "tenant-id",
 		Usage: `The <tenant-id> used to replace the templatized tenantid value in the OpenID Configuration.`,
 	}
+	oidcScopeFlag = cli.StringSliceFlag{
+		Name: "scope",
+		Usage: `The <scope> list used to validate the scopes extension in an OpenID Connect token.
+Use the '--scope' flag multiple times to configure multiple scopes.`,
+	}
+	oidcAuthParamFlag = cli.StringSliceFlag{
+		Name: "auth-param",
+		Usage: `The <auth-param> list used to validate the auth-params extension in an OpenID Connect token.
+Use the '--auth-param' flag multiple times to configure multiple auth-params.`,
+	}
 
 	// X5C provisioner flags
 	x5cRootsFlag = cli.StringFlag{

command/ca/provisioner/update.go

@@ -51,6 +51,8 @@ OIDC
 [**--domain**=<domain>] [**--remove-domain**=<domain>]
 [**--group**=<group>] [**--remove-group**=<group>]
 [**--admin**=<email>]... [**--remove-admin**=<email>]...
+[**--scope**=<scope>] [**--remove-scope**=<scope>]
+[**--auth-param**=<auth-param>] [**--remove-auth-param**=<auth-param>]
 [**--admin-cert**=<file>] [**--admin-key**=<file>]
 [**--admin-subject**=<subject>] [**--admin-provisioner**=<name>] [**--admin-password-file**=<file>]
 [**--ca-url**=<uri>] [**--root**=<file>] [**--context**=<name>] [**--ca-config**=<file>]
@@ -112,6 +114,8 @@ SCEP
 			oidcRemoveDomainFlag,
 			oidcGroupFlag,
 			oidcTenantIDFlag,
+			oidcScopeFlag,
+			oidcAuthParamFlag,
 
 			// X5C Root Flag
 			x5cRootsFlag,
@@ -791,6 +795,18 @@ func updateOIDCDetails(ctx *cli.Context, p *linkedca.Provisioner) error {
 		}
 		details.ConfigurationEndpoint = ce
 	}
+	if ctx.IsSet("remove-scope") {
+		details.Scopes = removeElements(details.Scopes, ctx.StringSlice("remove-scope"))
+	}
+	if ctx.IsSet("scope") {
+		details.Scopes = append(details.Scopes, ctx.StringSlice("scope")...)
+	}
+	if ctx.IsSet("remove-auth-param") {
+		details.AuthParams = removeElements(details.AuthParams, ctx.StringSlice("remove-auth-param"))
+	}
+	if ctx.IsSet("auth-param") {
+		details.AuthParams = append(details.AuthParams, ctx.StringSlice("auth-param")...)
+	}
 	return nil
 }