OIDC: add support for account claim maps (#1186)

internal/cmd/commands/authmethodscmd/oidc_funcs.go

@@ -27,6 +27,7 @@ type extraOidcCmdVars struct {
 	flagIdpCaCerts                        []string
 	flagAllowedAudiences                  []string
 	flagClaimsScopes                      []string
+	flagAccountClaimMaps                  []string
 	flagDisableDiscoveredConfigValidation bool
 	flagDryRun                            bool
 }
@@ -42,6 +43,7 @@ const (
 	caCertFlagName                            = "idp-ca-cert"
 	allowedAudienceFlagName                   = "allowed-audience"
 	claimsScopes                              = "claims-scopes"
+	accountClaimMaps                          = "account-claim-maps"
 	stateFlagName                             = "state"
 	disableDiscoveredConfigValidationFlagName = "disable-discovered-config-validation"
 	dryRunFlagName                            = "dry-run"
@@ -59,6 +61,7 @@ func extraOidcActionsFlagsMapFuncImpl() map[string][]string {
 			caCertFlagName,
 			allowedAudienceFlagName,
 			claimsScopes,
+			accountClaimMaps,
 		},
 		"change-state": {
 			idFlagName,
@@ -129,6 +132,12 @@ func extraOidcFlagsFuncImpl(c *OidcCommand, set *base.FlagSets, _ *base.FlagSet)
 				Target: &c.flagClaimsScopes,
 				Usage:  `The optional claims scope requested. May be specified multiple times.`,
 			})
+		case accountClaimMaps:
+			f.StringSliceVar(&base.StringSliceVar{
+				Name:   accountClaimMaps,
+				Target: &c.flagAccountClaimMaps,
+				Usage:  `The optional account claim maps from custom claims to the standard claims of sub, name and email.  These maps are represented as key=value where the key equals the Provider from-claim and the value equals the Boundary to-claim.  For example "oid=sub". May be specified multiple times for different to-claims.`,
+			})
 		case stateFlagName:
 			f.StringVar(&base.StringVar{
 				Name:   stateFlagName,
@@ -258,6 +267,13 @@ func extraOidcFlagHandlingFuncImpl(c *OidcCommand, f *base.FlagSets, opts *[]aut
 	default:
 		*opts = append(*opts, authmethods.WithOidcAuthMethodClaimsScopes(c.flagClaimsScopes))
 	}
+	switch {
+	case len(c.flagAccountClaimMaps) == 0:
+	case len(c.flagAccountClaimMaps) == 1 && c.flagAccountClaimMaps[0] == "null":
+		*opts = append(*opts, authmethods.DefaultOidcAuthMethodAccountClaimMaps())
+	default:
+		*opts = append(*opts, authmethods.WithOidcAuthMethodAccountClaimMaps(c.flagAccountClaimMaps))
+	}
 	if c.flagDisableDiscoveredConfigValidation {
 		*opts = append(*opts, authmethods.WithOidcAuthMethodDisableDiscoveredConfigValidation(c.flagDisableDiscoveredConfigValidation))
 	}