Extra claims with Synology DSM

[GooRoo]

Hi guys,

I'm trying to solve the same problem as in #146. I set up an OIDC client on my NAS, and I am trying to log in using it. The difference is that I cannot use the username provided by tsidp, and renaming my NAS user is not an option.

Tsidp does not provide a preferred_username by default, however, I declare it as an extra claim in ACL grants like this:

		{
			"src": ["my.email@gmail.com"],
			"dst": ["tag:tsidp"],
			"app": {
				"tailscale.com/cap/tsidp": [{
					"extraClaims": {
						"preferred_username": "gooroo",
						"nickname": "GooRoo"
					}
				}]
			}
		},

Despite that, Synology DSM cannot use it to match against my local NAS user anyway, unfortunately. I don't know why exactly, but I have two major guesses:

1. Either due to the fact that it does not find it in claims_supported in /.well-known/openid-configuration…
2. or (which is more probable) it looks not into the data returned within the token, but instead requests the /userinfo which also does not contain it.

Is there any elegant way to make it work?