feat: add group-based role mapping for FreeIPA IAM

FreeIPA users were always assigned RoleUser regardless of their
group membership. This adds --ipa-admin-group-cn so that members
of a specified FreeIPA group are automatically granted the admin
role, and  --ipa-enable-userplus to elevate the default role to
userplus for all IPA users. The user_show RPC is updated to
request all attributes so that memberof_group is reliably
returned.

auth/iam.go

@@ -152,6 +152,8 @@ type Opts struct {
 	IpaVaultName                string
 	IpaUser                     string
 	IpaPassword                 string
+	IpaAdminGroupCN             string
+	IpaEnableUserPlus           bool
 	IpaInsecure                 bool
 }
 
@@ -179,7 +181,7 @@ func New(o *Opts) (IAMService, error) {
 			o.VaultServerCert, o.VaultClientCert, o.VaultClientCertKey)
 		fmt.Printf("initializing Vault IAM with %q\n", o.VaultEndpointURL)
 	case o.IpaHost != "":
-		svc, err = NewIpaIAMService(o.RootAccount, o.IpaHost, o.IpaVaultName, o.IpaUser, o.IpaPassword, o.IpaInsecure)
+		svc, err = NewIpaIAMService(o.RootAccount, o.IpaHost, o.IpaVaultName, o.IpaUser, o.IpaPassword, o.IpaAdminGroupCN, o.IpaEnableUserPlus, o.IpaInsecure)
 		fmt.Printf("initializing IPA IAM with %q\n", o.IpaHost)
 	default:
 		// if no iam options selected, default to the single user mode