16480: Merge branch 'master'

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>

diff --combined lib/config/config.default.yml
index 409d2ccfaab833a1f68854c2378f19d33a003e30,b9bc9c2c5ce4a28eb25015961b687cea449d503a..907acdc87847f9c052aee71c5e1d1fbe8c4f78aa
--- 1/lib/config/config.default.yml
--- 2/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@@ -440,13 -440,6 +440,13 @@@ Clusters
        # or omitted, pages are processed serially.
        BalanceCollectionBuffers: 1000
  
 +      # Maximum time for a rebalancing run. This ensures keep-balance
 +      # eventually gives up and retries if, for example, a network
 +      # error causes a hung connection that is never closed by the
 +      # OS. It should be long enough that it doesn't interrupt a
 +      # long-running balancing operation.
 +      BalanceTimeout: 6h
 +
        # Default lifetime for ephemeral collections: 2 weeks. This must not
        # be less than BlobSigningTTL.
        DefaultTrashLifetime: 336h
@@@ -576,6 -569,22 +576,22 @@@
          ClientID: ""
          ClientSecret: ""
  
+         # OpenID claim field containing the user's email
+         # address. Normally "email"; see
+         # https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+         EmailClaim: "email"
+ 
+         # OpenID claim field containing the email verification
+         # flag. Normally "email_verified".  To accept every returned
+         # email address without checking a "verified" field at all,
+         # use the empty string "".
+         EmailVerifiedClaim: "email_verified"
+ 
+         # OpenID claim field containing the user's preferred
+         # username. If empty, use the mailbox part of the user's email
+         # address.
+         UsernameClaim: ""
+ 
        PAM:
          # (Experimental) Use PAM to authenticate users.
          Enable: false

diff --combined lib/config/export.go
index 1c0662470f9e842d7723c3e1238681c58dc0350d,0ad4222f551ba1220d2459f4330e9a1e05240d44..d6b02b750de122582e35a5aa34b508861106ac40
--- 1/lib/config/export.go
--- 2/lib/config/export.go
+++ b/lib/config/export.go
@@@ -102,7 -102,6 +102,7 @@@ var whitelist = map[string]bool
        "Collections.WebDAVCache":                      false,
        "Collections.BalanceCollectionBatch":           false,
        "Collections.BalancePeriod":                    false,
 +      "Collections.BalanceTimeout":                   false,
        "Collections.BlobMissingReport":                false,
        "Collections.BalanceCollectionBuffers":         false,
        "Containers":                                   true,
@@@ -157,6 -156,9 +157,9 @@@
        "Login.OpenIDConnect.ClientSecret":             false,
        "Login.OpenIDConnect.Enable":                   true,
        "Login.OpenIDConnect.Issuer":                   false,
+       "Login.OpenIDConnect.EmailClaim":               false,
+       "Login.OpenIDConnect.EmailVerifiedClaim":       false,
+       "Login.OpenIDConnect.UsernameClaim":            false,
        "Login.PAM":                                    true,
        "Login.PAM.DefaultEmailDomain":                 false,
        "Login.PAM.Enable":                             true,

diff --combined lib/config/generated_config.go
index 30bc66fc1e15d972f6818a859d55495f40bd7f32,758dc2677cf233b0d4d61462e7ec73d607f69174..96da19dfcdc14c6e20f0d1ea348c2423f909b1ba
--- 1/lib/config/generated_config.go
--- 2/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@@ -446,13 -446,6 +446,13 @@@ Clusters
        # or omitted, pages are processed serially.
        BalanceCollectionBuffers: 1000
  
 +      # Maximum time for a rebalancing run. This ensures keep-balance
 +      # eventually gives up and retries if, for example, a network
 +      # error causes a hung connection that is never closed by the
 +      # OS. It should be long enough that it doesn't interrupt a
 +      # long-running balancing operation.
 +      BalanceTimeout: 6h
 +
        # Default lifetime for ephemeral collections: 2 weeks. This must not
        # be less than BlobSigningTTL.
        DefaultTrashLifetime: 336h
@@@ -582,6 -575,22 +582,22 @@@
          ClientID: ""
          ClientSecret: ""
  
+         # OpenID claim field containing the user's email
+         # address. Normally "email"; see
+         # https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
+         EmailClaim: "email"
+ 
+         # OpenID claim field containing the email verification
+         # flag. Normally "email_verified".  To accept every returned
+         # email address without checking a "verified" field at all,
+         # use the empty string "".
+         EmailVerifiedClaim: "email_verified"
+ 
+         # OpenID claim field containing the user's preferred
+         # username. If empty, use the mailbox part of the user's email
+         # address.
+         UsernameClaim: ""
+ 
        PAM:
          # (Experimental) Use PAM to authenticate users.
          Enable: false

diff --combined sdk/go/arvados/config.go
index 636728f1fd71feaad420cd9a018ba8e6d7d9cbc7,029e223218b2a5136b8eac2238b088e2ce4fb983..a54712f330ea2b1ff2a6b8107daec5639c082c32
--- 1/sdk/go/arvados/config.go
--- 2/sdk/go/arvados/config.go
+++ b/sdk/go/arvados/config.go
@@@ -126,7 -126,6 +126,7 @@@ type Cluster struct 
                BalancePeriod            Duration
                BalanceCollectionBatch   int
                BalanceCollectionBuffers int
 +              BalanceTimeout           Duration
  
                WebDAVCache WebDAVCacheConfig
        }
@@@ -158,10 -157,13 +158,13 @@@
                        AlternateEmailAddresses bool
                }
                OpenIDConnect struct {
-                       Enable       bool
-                       Issuer       string
-                       ClientID     string
-                       ClientSecret string
+                       Enable             bool
+                       Issuer             string
+                       ClientID           string
+                       ClientSecret       string
+                       EmailClaim         string
+                       EmailVerifiedClaim string
+                       UsernameClaim      string
                }
                PAM struct {
                        Enable             bool