Expose OIDC token claims to the authorization scriptlet

[zyojv]

Is there an existing issue for this?

• There is no existing issue for this feature

What are you currently unable to do

Let the authorization scriptlet read the caller's validated OIDC/JWT claims (for example as details.Claims), so operators can write rules based on a groups or tenant claim.

Problem

The scriptlet's authorize(details, object, entitlement) function currently only sees Username, Protocol, IsAllProjectsRequest, ProjectName, Chain, and Certificate.

For an OIDC client, every other claim in the token (groups, email, roles, custom claims) is dropped before the scriptlet runs. So the scriptlet can decide based on who the user is, but not on the group or tenant membership the identity provider already put in the token.

Use case

Multi-tenant setup, one project per tenant, with membership managed in the IdP and delivered as a claim:

{ "sub": "b1a2...", "email": "alice@example.com", "groups": ["tenanta"] }

The goal is a simple rule: members of tenanta are operators on project tenanta, nothing else. That policy already exists in the IdP, but Incus can't act on it today, so the mapping has to be duplicated inside the scriptlet and kept in sync by hand.

Proposed change

Add the validated claims to details as a dict:

def authorize(details, object, entitlement):
    if details.Protocol != "oidc":
        return False

    groups = details.Claims.get("groups", [])
    # object matching is illustrative; adapt to Incus's object format.
    for group in groups:
        if object == "project:" + group or object.startswith("instance:" + group + "/"):
            return True
    return False

What do you think would need to be added

No response