claims: add JSON serialization for interface arrays

Implement handling of []interface{} types by serializing them to
JSON string format. This allows arrays like ["role1", "role2"] to
be converted to string representations for further processing.

Author: othman-essabir

.changelog/26958.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+oidc: add support for array-based OIDC claims
+```

lib/auth/claims.go

@@ -152,16 +152,23 @@ func getClaim(all map[string]interface{}, claim string) interface{} {
 // stringifyClaimValue will try to convert the provided raw value into a
 // faithful string representation of that value per these rules:
 //
-// - strings      => unchanged
-// - bool         => "true" / "false"
-// - json.Number  => String()
-// - float32/64   => truncated to int64 and then formatted as an ascii string
-// - intXX/uintXX => casted to int64 and then formatted as an ascii string
+// - []interface{} => marshaling to JSON string
+// - strings       => unchanged
+// - bool          => "true" / "false"
+// - json.Number   => String()
+// - float32/64    => truncated to int64 and then formatted as an ascii string
+// - intXX/uintXX  => casted to int64 and then formatted as an ascii string
 //
 // If successful the string value and true are returned. otherwise an empty
 // string and false are returned.
 func stringifyClaimValue(rawValue interface{}) (string, bool) {
 	switch v := rawValue.(type) {
+	case []interface{}:
+		b, err := json.Marshal(v)
+		if err != nil {
+			return "", false
+		}
+		return string(b), true
 	case string:
 		return v, true
 	case bool:

lib/auth/claims_test.go

@@ -68,6 +68,24 @@ func TestSelectorData(t *testing.T) {
 				},
 			},
 		},
+
+		{
+			"nested list claim",
+			nil,
+			map[string]string{"roles": "r"},
+			map[string]any{
+				"roles": []any{
+					[]any{"role1", "role2", "roleN"}, 42, false,
+				},
+			},
+			&structs.ACLAuthClaims{
+				Value: map[string]string{},
+				List: map[string][]string{
+					"r": {`["role1","role2","roleN"]`, "42", "false"},
+				},
+			},
+		},
+
 	}
 
 	for _, tt := range cases {