Support for JWT claims from RFC 9068 #16906
Description
Expected Behavior
RFC 9068 defines the claims "roles", "groups", and "entitlements", which can be useful for transmitting standardised information. These are structured values from SCIM defined by RFC 7643.
Some support in parsing them would be nice. Ideally a getRoles() method somewhere returning e.g. List<SCIMRole> etc.
Current Behavior
The claims set is typed as just a Map<String, Object, requiring a lot of casting (often unchecked) and verification to get at these structures.
Context
Mapping these concepts to ROLE_ authorities and ACL domain principals rather than having to do full user lookups (which may not be possible in some architectures) at the resource server.