Claim-based login authorization

[smoehrle]

Would it be possible to have an additional setting like "require_attribute"? Before the user can log in, it is checked if the required attribute is present in the claim. If this check fails, the user is not able to login. This way not all users within a realm in your keycloak would be able to access sonar.

(To the best of my knowledge) Currently our OIDC-provider (keycloak) can only authenticate and all users are automatically authorized to login. There is no option to deny access to users within a realm. With this new option sonar could explicitly authorize users to connect to the service.

[tjuerge]

This could be implemented in OidcIdentityProvider.callback() by checking the UserInfo's underlying ClaimSet for the existance of the "require_attribute" (via UserInfo.getClaim(config.getRequireAttribute())). If the claim is not present the authentication workflow is stopped with an IllegalStateException.