Support sending `email_verified` claim

[sherif-fanous]

Hi

I tried testing tsidp with Omni and it failed because Omni validates the returned JWT and expects that the email_verified claim is sent with a value of true

Currently tsidp is not sending this claim and therefore the auth flow fails.

[mostlygeek]

hi @sherif-fanous,

In v0.0.4 you can set an application cap grant for email_verified: true and it should be included in the id_token and /userinfo endpoints.

"grants": [
  {
    "src": ["*"],
    "dst": ["*"],

    "app": {
      "tailscale.com/cap/tsidp": [
        {
          "extraClaims": {
            "email_verified": true,
          },
          "includeInUserInfo": true,
        },
      ],
    },
  },
],