feat: Role mapping support in pac4j extension

[nozjkoitop]

Description

This PR is aimed to enable flexible mapping of OIDC/JWT roles to Druid roles.
By default, the pac4j OIDC authentication only maps the sub claim to a single Druid role, which is extremely inconvenient.
This PR adds support for extracting roles from any nested claim path in the JWT.

Configuration

New property introduced in runtime.properties:

# Dot-separated path to the claim containing user roles
druid.auth.pac4j.oidc.roleClaimPath=resource_access.client.roles

When set, all values found at roleClaimPath are mapped 1:1 to Druid roles.

• Path format: a.b.c for nested JSON fields
• Claim may contain a single value or be multivalued
• If not set, behavior remains unchanged (maps sub to a single Druid role)

Example JWT payload

{
  "iss": "https://idp.example.com/",
  "sub": "user123",
  "...": "...",
  "resource_access": {
    "client": {
      "roles": ["role1", "role2"]
    }
  },
  "...": "..."
}

With the configuration:

druid.auth.pac4j.oidc.roleClaimPath=resource_access.client.roles

The authenticated user will be assigned Druid roles role1 and role2, if those roles exist in the Druid security configuration.

Release note

Added support for extracting OIDC/JWT roles from a configurable nested claim path and mapping them directly to Druid roles.

---

Key changed/added classes in this PR

• RoleBasedAuthGen
• Pac4jFilter
• RoleProviderUtil
• LDAPRoleProvider
• MetadataStoreRoleProvider

---

This PR has:

• been self-reviewed.
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.

[AdheipSingh]

cc @pjain1 @capistrant can you help in reviewing this.

[AdheipSingh]

As per our discussion on druid slack , i'm tagging @kfaraz for review.
Thanks for the coordination.

[kfaraz]

Thanks, @AdheipSingh ! I will try to prioritize the review of this PR soon.

[nozjkoitop]

Hey, @kfaraz! Quick ping on this PR is it still on your radar?

[pjain1]

If there is a role claim set i.e. values is not null but we don't find expected type here then instead of returning null and thus not enforcing any role should we throw error?

[nozjkoitop]

Id not throw here, cuz it's more of a misconfiguration than an exceptional case, however i can add warnings on such cases to pinpoint the issue

[nozjkoitop]

Hi @kfaraz, following up on this PR, wanted to check whether you’ve had a chance to look at it

[FrankChen021]

Findings that could not be attached inline:

• extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/JwtAuthFilter.java:90 - [P2] roleClaimPath is ignored by the JWT authenticator. The new OIDCConfig property is documented in the shared pac4j extension configuration, which also documents the jwt authenticator mode, but JwtAuthFilter still creates AuthenticationResult with a null context after validating the ID token. For deployments using druid.auth.authenticator.jwt.type=jwt, configuring roleClaimPath has no effect and authorization falls back to identity-based roles. Extract the configured claim from the validated IDTokenClaimsSet and pass it under the same role context key, or document that the JWT authenticator is unsupported.

[FrankChen021]

[P2] OIDC role extraction ignores validated ID-token claims

RoleBasedAuthGen reads only OidcProfile.getAccessToken() and parses that token for the configured role claim. If the role claim is in the validated ID token/profile claims, or the provider issues opaque access tokens, this silently extracts no roles and Druid falls back to identity-based roles. Use the already validated OIDC profile or ID-token claims, or support both token sources with tests for ID-token-only roles.

[nozjkoitop]

Addressed. Docs updated, ID token claim retrieval added

[nozjkoitop]

faulty test passes locally and feels completely unrelated to changes