Say when a rule names a claim the provider answers with objects

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[augmentcode]

🤖 Augment PR Summary

Summary: This PR improves operator diagnostics when an OIDC policy denies a user because the IdP returns certain claims in an “object” shape (e.g., SCIM-like objects with value/display) rather than the string values the policy rule names.

Changes:

• Added detection for claims that arrive as objects (or arrays containing objects) in enterprise authentication logic.
• Introduced Authentication::object_shaped_claims() to surface which configured rule names map to object-shaped provider claims.
• On callback denial, the enterprise server now logs a one-time message per claim/policy to highlight this mismatch and how comparisons are performed (identifier vs display name).
• Added a unit test covering object-shaped vs string-shaped vs absent claims for an OIDC policy.
• Added a community-edition stub implementation returning an empty result (feature is only meaningful with interactive/OIDC policies).

Technical Notes: The new detection aligns with existing claim matching behavior that compares object-shaped claims via their value sub-attribute.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

report_object_shaped_claims is always passed token.value().payload(), but admission may have been re-evaluated using combine_claims(token.payload(), extra) after a UserInfo fetch. If the object-shaped claim arrives from UserInfo (which is common in the code flow), this log path would miss it and could hide the root cause of the denial.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

Benchmark Index (community)

Details

Benchmark suite	Current: 13d6220	Previous: 6272cc7	Ratio
Add one schema (0 existing)	328 ms	353 ms	0.93
Add one schema (100 existing)	30 ms	34 ms	0.88
Add one schema (1000 existing)	93 ms	111 ms	0.84
Add one schema (10000 existing)	803 ms	926 ms	0.87
Update one schema (1 existing)	22 ms	24 ms	0.92
Update one schema (101 existing)	31 ms	35 ms	0.89
Update one schema (1001 existing)	96 ms	110 ms	0.87
Update one schema (10001 existing)	794 ms	924 ms	0.86
Cached rebuild (1 existing)	8 ms	9 ms	0.89
Cached rebuild (101 existing)	10 ms	12 ms	0.83
Cached rebuild (1001 existing)	38 ms	44 ms	0.86
Cached rebuild (10001 existing)	319 ms	380 ms	0.84
Index 100 schemas	613 ms	616 ms	1.00
Index 1000 schemas	1340 ms	1493 ms	0.90
Index 10000 schemas	13831 ms	13984 ms	0.99
Index 10000 schemas (custom meta-schema)	16644 ms	17115 ms	0.97
Index 10000 schemas ($ref fan-out)	16633 ms	17213 ms	0.97

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Benchmark Index (enterprise)

Details

Benchmark suite	Current: 13d6220	Previous: 6272cc7	Ratio
Add one schema (0 existing)	397 ms	398 ms	1.00
Add one schema (100 existing)	107 ms	108 ms	0.99
Add one schema (1000 existing)	167 ms	166 ms	1.01
Add one schema (10000 existing)	834 ms	851 ms	0.98
Update one schema (1 existing)	97 ms	98 ms	0.99
Update one schema (101 existing)	106 ms	104 ms	1.02
Update one schema (1001 existing)	166 ms	166 ms	1
Update one schema (10001 existing)	839 ms	841 ms	1.00
Cached rebuild (1 existing)	9 ms	9 ms	1
Cached rebuild (101 existing)	12 ms	12 ms	1
Cached rebuild (1001 existing)	39 ms	39 ms	1
Cached rebuild (10001 existing)	320 ms	319 ms	1.00
Index 100 schemas	675 ms	692 ms	0.98
Index 1000 schemas	1447 ms	1430 ms	1.01
Index 10000 schemas	13982 ms	14152 ms	0.99
Index 10000 schemas (custom meta-schema)	16864 ms	17126 ms	0.98
Index 10000 schemas ($ref fan-out)	16519 ms	17238 ms	0.96

This comment was automatically generated by workflow using github-action-benchmark.