feat: add group-based role mapping for FreeIPA IAM

FreeIPA users were always assigned RoleUser regardless of their
group membership. This adds --ipa-admin-group-cn so that members
of a specified FreeIPA group are automatically granted the admin
role, and  --ipa-enable-userplus to elevate the default role to
userplus for all IPA users. The user_show RPC is updated to
request all attributes so that memberof_group is reliably
returned.

embedgw/embedgw.go

@@ -272,6 +272,12 @@ type Config struct {
 	IpaUser string
 	// IpaPassword is the FreeIPA password for authentication.
 	IpaPassword string
+	// IpaAdminGroupCN is the CN of the FreeIPA group whose members are granted
+	// the admin role. If empty, all users are assigned the user role.
+	IpaAdminGroupCN string
+	// IpaEnableUserPlus grants all FreeIPA users the userplus role by default
+	// instead of the user role. Members of IpaAdminGroupCN still get admin.
+	IpaEnableUserPlus bool
 	// IpaInsecure disables TLS certificate verification for the FreeIPA
 	// connection.
 	IpaInsecure bool
@@ -647,6 +653,8 @@ func RunVersityGW(ctx context.Context, be backend.Backend, cfg *Config) error {
 		IpaVaultName:                cfg.IpaVaultName,
 		IpaUser:                     cfg.IpaUser,
 		IpaPassword:                 cfg.IpaPassword,
+		IpaAdminGroupCN:             cfg.IpaAdminGroupCN,
+		IpaEnableUserPlus:           cfg.IpaEnableUserPlus,
 		IpaInsecure:                 cfg.IpaInsecure,
 	})
 	if err != nil {