OIDC: add support for account claim maps (#1186)

internal/servers/controller/handlers/authmethods/authmethod_service.go

@@ -678,6 +678,7 @@ func toAuthMethodProto(in auth.AuthMethod, opt ...handlers.Option) (*pb.AuthMeth
 			SigningAlgorithms: i.GetSigningAlgs(),
 			AllowedAudiences:  i.GetAudClaims(),
 			ClaimsScopes:      i.GetClaimsScopes(),
+			AccountClaimMaps:  i.GetAccountClaimMaps(),
 		}
 		if i.DisableDiscoveredConfigValidation {
 			attrs.DisableDiscoveredConfigValidation = true
@@ -814,6 +815,19 @@ func validateCreateRequest(req *pbs.CreateAuthMethodRequest) error {
 						}
 					}
 				}
+				if len(attrs.GetAccountClaimMaps()) > 0 {
+					acm, err := oidc.ParseAccountClaimMaps(attrs.GetAccountClaimMaps()...)
+					if err != nil {
+						badFields[accountClaimMapsField] = fmt.Sprintf("Contains invalid map %q", err.Error())
+					}
+					foundTo := make(map[string]bool, len(attrs.GetAccountClaimMaps()))
+					for from, rawTo := range acm {
+						if foundTo[rawTo] {
+							badFields[accountClaimMapsField] = fmt.Sprintf("%s=%s contains invalid map - multiple maps to the same Boundary to-claim %s", from, rawTo, rawTo)
+						}
+						foundTo[rawTo] = true
+					}
+				}
 			}
 		default:
 			badFields[typeField] = fmt.Sprintf("This is a required field and must be %q.", auth.PasswordSubtype.String())
@@ -922,6 +936,30 @@ func validateUpdateRequest(req *pbs.UpdateAuthMethodRequest) error {
 					}
 				}
 			}
+			if len(attrs.GetAccountClaimMaps()) > 0 {
+				acm, err := oidc.ParseAccountClaimMaps(attrs.GetAccountClaimMaps()...)
+				if err != nil {
+					badFields[accountClaimMapsField] = fmt.Sprintf("Contains invalid map %q", err.Error())
+				} else {
+					foundTo := make(map[string]bool, len(attrs.GetAccountClaimMaps()))
+					for from, rawTo := range acm {
+						if foundTo[rawTo] {
+							badFields[accountClaimMapsField] = fmt.Sprintf("%s=%s contains invalid map - multiple maps to the same Boundary to-claim %s", from, rawTo, rawTo)
+						}
+						foundTo[rawTo] = true
+
+						to, err := oidc.ConvertToAccountToClaim(rawTo)
+						if err != nil {
+							badFields[accountClaimMapsField] = fmt.Sprintf("%s=%s contains invalid map %q", from, rawTo, err.Error())
+							break
+						}
+						if to == oidc.ToSubClaim {
+							badFields[accountClaimMapsField] = fmt.Sprintf("%s=%s contains invalid map: not allowed to update sub claim maps", from, rawTo)
+							break
+						}
+					}
+				}
+			}
 		default:
 			badFields["id"] = "Incorrectly formatted identifier."
 		}