Server does not start if users contain unknown claims

[kjvalencik]

What happened:

A rule was added on an Auth0 connection to add a custom claim to tokens. An OIDC connection was used for external storage of Teleport users. Afterwards, teleport server crashed and would not start until the users were manually deleted from DynamoDB.

What you expected to happen:

Log entries about the unknown claim (possibly refuse login), but teleport server to continue to operate normally.

How to reproduce it (as minimally and precisely as possible):

Login on an OIDC connection with a custom claim. E.g, "http://example.com/permissions": "read write"

Environment:

• Teleport version (use teleport version): 3.2.4, 3.2.13, 4.1.0
• Tsh version (use tsh version): N/A
• OS (e.g. from /etc/os-release): docker

Browser environment

N/A

• Browser Version (for UI-related issues):
• Install tools:
• Others:

Relevant Debug Logs If Applicable

teleport-5d6647b4ff-ffrh6 teleport ERROR REPORT:
teleport-5d6647b4ff-ffrh6 teleport Original Error: *trace.BadParameterError failed to validate: https://tools;example;com/user_permissions: Additional property https://tools;example;com/user_permissions is not allowed
teleport-5d6647b4ff-ffrh6 teleport Stack Trace:
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/services/user.go:628 github.com/gravitational/teleport/lib/services.(*TeleportUserMarshaler).UnmarshalUser
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/services/local/users.go:119 github.com/gravitational/teleport/lib/services/local.(*IdentityService).GetUser
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/services/local/users.go:68 github.com/gravitational/teleport/lib/services/local.(*IdentityService).GetUsers
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/auth/init.go:464 github.com/gravitational/teleport/lib/auth.migrateUsers
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/auth/init.go:405 github.com/gravitational/teleport/lib/auth.migrateLegacyResources
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/auth/init.go:389 github.com/gravitational/teleport/lib/auth.Init
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/service/service.go:900 github.com/gravitational/teleport/lib/service.(*TeleportProcess).initAuthService
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/service/service.go:602 github.com/gravitational/teleport/lib/service.NewTeleport
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/e/lib/pro/process.go:41 github.com/gravitational/teleport/e/lib/pro.NewTeleport
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/e/tool/teleport/main.go:35 main.run.func1
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/lib/service/service.go:372 github.com/gravitational/teleport/lib/service.Run
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/e/tool/teleport/main.go:43 main.run
teleport-5d6647b4ff-ffrh6 teleport     /gopath/src/github.com/gravitational/teleport/e/tool/teleport/main.go:27 main.main
teleport-5d6647b4ff-ffrh6 teleport     /opt/go/src/runtime/proc.go:210 runtime.main
teleport-5d6647b4ff-ffrh6 teleport     /opt/go/src/runtime/asm_amd64.s:1334 runtime.goexit
teleport-5d6647b4ff-ffrh6 teleport User Message: failed to validate: https://tools;example;com/user_permissions: Additional property https://tools;example;com/user_permissions is not allowed, initialization failed