Auth0 rule reintegrates groups

[andrewkrug]

The current auth0 rule that enriched the profile should re-integrate groups to facilitate co-existence of ldap with CIS.

[gdestuynder]

Added safety/whitelist of CIS Integrated profiles in https://github.com/mozilla-iam/auth0-deploy/pull/108

[gdestuynder]

and in working on this I noticed:

• auth0 behavior changed and it now automatically populate user.app_metadata into the user profile, so the rule is not needed
• the rules take effect BEFORE auth0 integration, so we cannot reintegrate
• client_metadata is limited to 15 fields so can't contain our profile data
• the values are not accessible directly, though MAYBE we could do an API call with a refresh token from the rule to re-integrate
• turning on OIDC conformance mode stops automatically overwriting things, but also does not allow optional claims (though I believe openidc does not forbid this.. auth0 does anyway). Auth0 allows for namespaced fields - but that also means the attribute "groups" cannot exist - it can only do "https://a/groups" which RPs will not understand
• auth0 claims they won't fix issues when OIDC conformance mode is off (note: its what auth0 calls OIDC conformance mode, its not necessarily 100% OIDC conformant per se)

[gdestuynder]

Note: I believe I could also do the group integration through the API, so i'll try that hopefully tomorrow.

[gdestuynder]

Work-around through the API:

https://github.com/mozilla-iam/cis_functions/pull/12

[gdestuynder]

note: closed the rule PR (#108 above) as auth0 force integrates app_metadata now, the rule has no effect and cannot control the data. The PR https://github.com/mozilla-iam/cis_functions/pull/12 does this via the API instead

[gdestuynder]

mozilla-iam/cis_functions#12 fixes this