As sketched here:

https://developer.okta.com/blog/2018/02/27/a-breakdown-of-the-new-saml-authentication-bypass-vulnerability

Thought it was interesting to see how our SAML connector behaved. And
it seems to be behaving well. :)
Signed-off-by: Stephan Renatus <srenatus@chef.io>

Add missing word

New id_provider scope that adds the connector ID and user ID to the ID token claims

Add new federated:id scope that causes Dex to add a federated_claims claim containing the connector_id and user_id to the ID token

handlers/connector_login: update AuthRequest irregardless of method

1170 - Fix comment typos

  BsaeDN should be BaseDN

automated PR: update CoC and legalese

README: expand connector docs and assign each a level of support

Documentation: restructure connector docs to a single folder

Add Prometheus metrics

document limitations in the OpenID Connect connector

license: add bill of materials.

Clarify email scope description

Signed-off-by: Stephan Renatus <srenatus@chef.io>

Update slapd.sh

Before, you could not POST your credentials to a password-connector's
endpoint without GETing that endpoint first. While this makes sense for
browser clients; automated interactions with Dex don't need to look at
the password form to fill it in.

A symptom of that missing GET was that the POST succeeded (!) with

    login successful: connector "", username="admin", email="admin@example.com", groups=[]

Note the connector "". A subsequent call to finalizeLogin would then
fail with

    connector with ID "" not found: failed to get connector object from storage: not found

Now, the connector ID of an auth request will be updated for both GETs
and POSTs.
Signed-off-by: Stephan Renatus <srenatus@chef.io>

Correct "Verifier" method name in using-dex doc

Change provider.NewVerifier to provider.Verifier per the godocs:
https://godoc.org/github.com/coreos/go-oidc#Provider.Verifier

Bugfix: Set a proper status code before sending an error status page

*: fix proto build

Implement Microsoft (Azure AD) connector

Specify Java package for dex Protobuf API

Microsoft connector now provides support for 'groups' claim in case
'tenant' is configured in Dex config for the connector. It's possible to
deny user authentication if the user is not a member of at least one
configured groups.
Signed-off-by: Pavel Borzenkov <pavel.borzenkov@gmail.com>

connector/microsoft implements authorization strategy via Microsoft's
OAuth2 endpoint + Graph API. It allows to choose what kind of tenants
are allowed to authenticate in Dex via Microsoft:
  * common - both personal and business/school accounts
  * organizations - only business/school accounts
  * consumers - only personal accounts
  * <tenant uuid> - only account of specific tenant
Signed-off-by: Pavel Borzenkov <pavel.borzenkov@gmail.com>