Merge branch 'master' of github.com:smallstep/certificates into ssh-ca

authority/provisioner/oidc.go

@@ -39,6 +39,7 @@ type openIDPayload struct {
 	EmailVerified   bool     `json:"email_verified"`
 	Hd              string   `json:"hd"`
 	Nonce           string   `json:"nonce"`
+	Groups          []string `json:"groups"`
 }
 
 // OIDC represents an OAuth 2.0 OpenID Connect provider.
@@ -52,6 +53,7 @@ type OIDC struct {
 	ConfigurationEndpoint string   `json:"configurationEndpoint"`
 	Admins                []string `json:"admins,omitempty"`
 	Domains               []string `json:"domains,omitempty"`
+	Groups                []string `json:"groups,omitempty"`
 	Claims                *Claims  `json:"claims,omitempty"`
 	configuration         openIDConfiguration
 	keyStore              *keyStore
@@ -187,6 +189,22 @@ func (o *OIDC) ValidatePayload(p openIDPayload) error {
 		}
 	}
 
+	// Filter by oidc group claim
+	if len(o.Groups) > 0 {
+		var found bool
+		for _, group := range o.Groups {
+			for _, g := range p.Groups {
+				if g == group {
+					found = true
+					break
+				}
+			}
+		}
+		if !found {
+			return errors.New("validation failed: invalid group")
+		}
+	}
+
 	return nil
 }