Support for optional claims from OIDC providers

[gheibia]

Preflight checklist

• [X] I could not find a solution in the existing issues, docs, nor discussions.
• [X] I agree to follow this project's Code of Conduct.
• [X] I have read and am following this repository's Contribution Guidelines.
• [ ] This issue affects my Ory Cloud project.
• [X] I have joined the Ory Community Slack.
• [ ] I am signed up to the Ory Security Patch Newsletter.

Describe your problem

Current Claim struct only support common claims amongst all providers. There is no way to include optional claims.

For instance, with Azure AD one can add Application Roles to the ID Token: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps

These roles could then be added to an identity's metadata or traits to be used later (e.g.: Fine-grained authorization).

Describe your ideal solution

I thought about different solutions and the one that stood out to me and is least impactful is this (I can put out a PR if needed):

1. Update the Claims struct to include a map[string]string for optional claims.
2. Update Microsoft Provider to implement verifyAndDecodeClaimsWithProvider (from the embedded ProviderGenericOIDC) to populate the new map when building a claims object. This requires:
   1. Adding a local struct (e.g.: microsoftClaims) to Microsoft Provider embedding Claims struct. This new struct will contain any new claim in the ID Token as a field. We'll pass a reference to a microsoftClaims object to the Claims method of goodic.IDToken instead.
   2. Once populated, copy the optional claims from microsoftClaims to Claims' new optional claims map.

With this approach any provider that needs extra claims can implement this method and populate them in the new map.

Workarounds or alternatives

I couldn't find a work around for this. There are endpoints in Azure AD which I can call (using hooks for example) to get assigned roles, but they need elevated permissions.

Version

0.10.1

Additional Context

No response

[gheibia]

Alternatively, I can update the existing microsoftUnverifiedClaims struct and add a field for Roles. Keep everything else as is and simply copy the roles from microsoftUnverifiedClaims to Claims struct's new map.

[gheibia]

Hello, was wondering if someone could give me a feedback on this. I'd like to start working on this.

[aeneasr]

This is now merged on master :)

[gheibia]

Could you please point me to the PR? Neither Claims struct nor Microsoft Provider seem to have been changed.

[aeneasr]

https://github.com/ory/kratos/pull/2765

[gheibia]

Awesome! I'm gonna try this. Thank you.