Support custom claims for keycloak provider

[olee]

Currently the keycloak provider seems to drop any custom claims present in the token: https://github.com/supabase/gotrue/blob/master/internal/api/provider/keycloak.go#L80-L90

Other providers like the Azure provider for example do map custom claims to be present in the metadata: https://github.com/supabase/gotrue/blob/master/internal/api/provider/oidc.go#L301

EDIT: I managed to locally adjust the code for the keycloak provider to make this work. Will try to prepare a PR soon:

// internal/api/provider/keycloak.go

func (g keycloakProvider) GetUserData(ctx context.Context, tok *oauth2.Token) (*UserProvidedData, error) {
	var userinfo map[string]interface{}

	if err := makeRequest(ctx, tok, g.Config, g.Host+"/protocol/openid-connect/userinfo", &userinfo); err != nil {
		return nil, err
	}

	var u keycloakUser = keycloakUser{
		Name:          userinfo["name"].(string),
		Sub:           userinfo["sub"].(string),
		Email:         userinfo["email"].(string),
		EmailVerified: userinfo["email_verified"].(bool),
	}

	if u.Email == "" {
		return nil, errors.New("unable to find email with Keycloak provider")
	}

	// Copy all other claims from userinfo into customClaims
	var customClaims map[string]interface{} = make(map[string]interface{})
	for k, v := range userinfo {
		if k != "name" && k != "sub" && k != "email" && k != "email_verified" {
			customClaims[k] = v
		}
	}

	return &UserProvidedData{
		Metadata: &Claims{
			Issuer:        g.Host,
			Subject:       u.Sub,
			Name:          u.Name,
			Email:         u.Email,
			EmailVerified: u.EmailVerified,
			CustomClaims:  customClaims,

			// To be deprecated
			FullName:   u.Name,
			ProviderId: u.Sub,
		},
		Emails: []Email{{
			Email:    u.Email,
			Verified: u.EmailVerified,
			Primary:  true,
		}},
	}, nil

}

[wdoppenberg]

@olee Did you manage to get a working solution ready for review? If not I am happy to claim this issue

[olee]

No, you are free to claim this one of course.

[wdoppenberg]

supabase/auth#1917

[DavidSubiros]

Same with WorkOS, I wanted to map some claims via the JWT template available in WorkOS, but found that Supabase has only a hardcoded
CustomClaims mapping (under. api/provider/workos.go ) - we ended up using the custom_access_token_hook to request the info via an http call against WorkOS, but this is not ideal. It would be nice to have a way to personalize CustomClaims (ideally, for any provider)