feat: map broker claims to realm roles

scripts/configure-google-idp.sh

@@ -144,6 +144,10 @@ upsert_mapper \
   "google-hosted-domain" \
   "oidc-user-attribute-idp-mapper" \
   '{"syncMode":"INHERIT","claim":"hd","user.attribute":"hd"}'
+upsert_mapper \
+  "google-example-domain-role" \
+  "oidc-role-idp-mapper" \
+  '{"syncMode":"INHERIT","claim":"hd","claim.value":"example.test","role":"employee-role"}'
 
 echo "Google Identity Provider $action for realm '$realm'"
 echo "Register this exact Google redirect URI:"

scripts/verify-google-claim-to-role.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env sh
+set -eu
+
+set -a
+. ./.env
+set +a
+
+./scripts/configure-broker-user-profile.sh >/dev/null
+./scripts/set-first-broker-login-mode.sh secure
+
+docker compose exec -T keycloak \
+  /opt/keycloak/bin/kcadm.sh create roles -r keycloak-patterns \
+  -s name=employee-role \
+  -s 'description=Assigned from the upstream hd claim' >/dev/null 2>&1 || true
+
+cd google-e2e
+npm install --ignore-scripts
+npm run test:claim-to-role