assign user roles based on userinfo claims

Today, there is only an option to assign a default role for each user logging in via OIDC. Alternatively, a role can be specified by creating a email invite.

We should investigate on how we could instead assign roles based on claims. We need to see what customers want here.