Custom claim support

[artagel]

This branch adds the following capabilities:

• Parsing of 'claims' from OIDC providers into a new map in the userstruct called MappedClaims
• A claims config item to allow a user to specify which claims they would like to store (instead of storing all claims)
• A globalClaimWhiteList config item to allow users to set global whitelists based on anything in the user struct, including custom mapped claims (This may be able to replace the whiteList option, since we can also globally check authorization based on username/email since it is in the user struct)
• An authorization config item to allow users to set authorization per host(application) being proxied by anything in the user struct, including custom claims.
• An addition to the headers config item called mappedClaims that allows a user to map the values of claims into headers passed to nginx. This now provides complete dynamic header->claim mapping for users. ( I believe this fixes Passing original JWT through as a header #43, Not able set additional claims to Ngnix proxy header #80, and Other data from IdP call to be made available in headers #27).

I have not been able to test the claims parsing for indie auth, google, or github. But is has been tested for generic OIDC (Using Keycloak) and ADFS.

[artagel]

Any questions on this one?

[bnfinet]

@artagel thanks for the contribution and the nudge. I very much appreciate the interest in Vouch Proxy and the effort in improving the code base.

I've been considering how best to respond to this. I'd like to work with you to split this PR into several discreet items.

I see these features, each of which should be separated out...

• /validate returns headers with claims
• /validate authorization per host based on claims in jwt
• globalClaimWhiteList for any claim
• configure which claims to store

However, even before we get to the code, I'd like to discuss the concepts with you in separate issues and talk about design in both code and config. In general for concepts of this impact it'd be best to propose functionality before coding an implementation.

Please do open issues for each of these concepts. Its tempting to discuss those concepts here and direct you towards other code and thought that has already been conducted but that's better done in an issue. That will also make it easier to draw in other contributors to the project and solicit their opinion on the design.

I'm going to close this PR for now.

But let me clear, I do appreciate what you're heading towards here and I look forward to working with you to add this functionality to Vouch Proxy.

[RainerGanss]

@bnfinet would it be possible to link the created issues to this one? This is the first google hit and I could not find the corresponding issues unfortunately.

[bnfinet]

I think #102 #95 and #97 are relevant