Change validation of OIDC token issuer to support parameterized queries

[sp193]

The existing OIDC SSO support works okay, but it is incompatible with Entra ID's Multitenant mode. This is the same problem as KeyCloak's keycloak/keycloak#28662

As documented by Microsoft, the iss (issuer) field will contain the real tenant ID, while the issuer indicated in the .well-known document looks like this:

https://login.microsoftonline.com/{tenantid}/v2.0

However! The iss claim of the JWK will appear like this:

https://login.microsoftonline.com/f153796c-52b5-4ba0-bd31-9b41cb1361f1/v2.0

So if we simply entered the generic issuer value into AM for validating the JWK issuer, it'll result in a failure as the existing check just does a string comparison. However, we are required by the OIDC specification to validate the issuer.

My suggestion to increase flexibility in this area, is to allow the issuer field to contain references to values within the claims. For example, entering this:

https://login.microsoftonline.com/{tid}/v2.0

...will result in AM replacing {tid} with the tid (tenant ID) claim's value during the validation step:

https://login.microsoftonline.com/f153796c-52b5-4ba0-bd31-9b41cb1361f1/v2.0

---

Frankly, I do not know what Forgerock has done about this limitation, in recent AM versions. But I hope this modification would be acceptable as the OIDC specification specifies:

The Issuer Identifier [...] MUST exactly match the value of the iss (issuer) Claim.

...and Microsoft says:

The application must validate that the issuer property in the published metadata matches the iss claim in the token, in addition to the usual check that the iss claim in the token contains the tenant ID (tid) claim.

[sp193]

On a side note, I also had to specify a different method for "OpenID Connect validation configuration type". The default ".well-known/openid-configuration_url" option would result in a failure as this method involves some comparison of the issuer again.

I chose jwk_uri, but I suppose client_secret should be an equally viable alternative. Combining any of these with my patch, allowed me to use Entra ID's OIDC SSO in Multitenant mode.

[maximthomas]

Thanks for the contribution, @sp193!