fix: Fallback when group claim is a string instead of an array of strings

[JoooostB]

Overview

When using the OIDC provider, in combination with Microsoft ADFS using OpenID, groups can be filtered on Microsoft's side. Whenever the result of this filtering consists of only one group, the response back to Dex will be a string instead of an array of strings.

OIDC response examples:
Response with multiple groups:

{
  "aud": "microsoft:identityserver:XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX",
  "iss": "http://domain.acme.com/adfs/services/trust",
  "iat": 1661346019,
  "exp": 1661349619,
  "email": "[email protected]",
  "given_name": "Henk",
  "family_name": "Vries, De",
  "unique_name": "Vries, Henk de",
  "winaccountname": "henkie",
  "groupsid": [
    "K8s_P_Group1",
    "K8s_P_Group2"
  ],
  "group": [
    "K8s_P_Group1",
    "K8s_P_Group2"
  ],
  "apptype": "Confidential",
  "appid": "XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX",
  "authmethod": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
  "auth_time": "2022-08-24T12:17:06.060Z",
  "ver": "1.0",
  "scp": "openid"
}

Response with one group:

{
  "aud": "microsoft:identityserver:XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX",
  "iss": "http://domain.acme.com/adfs/services/trust",
  "iat": 1661346019,
  "exp": 1661349619,
  "email": "[email protected]",
  "given_name": "Henk",
  "family_name": "Vries, De",
  "unique_name": "Vries, Henk de",
  "winaccountname": "henkie",
  "groupsid": "K8s_P_Group1",
  "group": "K8s_P_Group1",
  "apptype": "Confidential",
  "appid": "XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX",
  "authmethod": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
  "auth_time": "2022-08-24T12:17:06.060Z",
  "ver": "1.0",
  "scp": "openid"
}

What this PR does / why we need it

This PR adds a fallback to the OIDC connector to add support for a singular group received as a string instead of an array of strings.

NONE

Co-authored-by: Michiel van Pouderoijen [email protected]
Signed-off-by: Joost Buskermolen [email protected]

[nabokihms]

@JoooostB great job! Seems ok to me, but adding a test is required to consolidate the logic.

[nabokihms]

Related #2562

[JoooostB]

@nabokihms I moved the fallback outside of the if statement for custom groupsKey to make sure it's executed when the default groupsKey is used. As requested I also created a testcase containing a singular group as a string.

[nabokihms]

@JoooostB thanks for contributing. LGTM!