[WIP] Improvements to handle custom and/or nested claims and/or dynamic client_id

[TBG-FR]

Here are some modifications to improve the options when using Keycloak

• Still works as before if you use "simple" values in roles settings
  e.g. rolename1;rolename2;rolename3 will still look for these values in user-realm-role
• Add the possibility to use a custom claim
  e.g. wp-roles.rolename1;wp-roles.rolename2;wp-roles.rolename3 will look for these values in wp-roles instead of user-realm-role
• Add the possibility to use a custom nested claim
  e.g. wp-roles.roles.aaa.rolename1;wp-roles.roles.a.aarolename2;wp-roles.roles.aaa.rolename3 will look for these values in wp-roles: { roles : { aaa: [ -> here <-] } } instead of user-realm-role
• Add the possibility to use a dynamic client_id in nested claim
  e.g. resource_access.$client_id.roles.editor will look for this value in resource_access: { wordpress-abc : { roles: [ -> here <-] } } instead of user-realm-role, if your client_id is wordpress-abc

When you go in Keycloak Admin Console, to Clients > Client details > Roles and add roles, these roles are specific to that client. Now you can reference them in Wordpress, using that (mu-)plugin ! 🥳

These code modifications has been tested with all use-cases described here. However, the code is a bit messy and could be improved/formatted/optimized 😅

Don't hesitate to give your thoughs ! I hope it will be flexible enough to fit the needs of everyone here 🙌

[murphysprings]

I think the new default mapper and token claim name is realm_access.roles. This replaces the user_claim.user-realm-role This is in KeyCloak 24

Go to Client Scopes --> roles --> Mappers (tab) --> realm roles. The Token Claim Name is realm_access.roles

You MUST select the "Add to userinfo" radial button

With this, and the modifications in this pull branch, the custom claims should be realm_access.roles.<role-name>. It works great!

[murphysprings]

Was running into an issue where the first time it found a match for a role, it would then add you to every remaining role in the loop.

Need to add this after line 312.

// reset these values at end of each foreach loop, otherwise the next iteration will keep old values
$idp_roles='';
$idp_claim='';

[murphysprings]

Need to insert these lines here; otherwise the $idp_claim value gets carried over into the next foreach loop:

// reset these values at end of each foreach loop, otherwise the next iteration will keep old values
$idp_roles='';
$idp_claim='';