Add ID Austria to the list of supported providers

Co-Authored-By: Kévin Chalet <kevinchalet@gmail.com>

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationHandlers.cs

@@ -1515,6 +1515,14 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                     // HubSpot returns the username as a custom "user" node:
                     ProviderTypes.HubSpot => (string?) context.UserInfoResponse?["user"],
 
+                    // ID Austria doesn't return a username so one is created using the standard "given_name"
+                    // and "family_name" claims extracted from the backchannel or frontchannel identity token:
+                    ProviderTypes.IdAustria
+                        when (context.BackchannelIdentityTokenPrincipal ?? // Always prefer the backchannel identity token when available.
+                              context.FrontchannelIdentityTokenPrincipal) is ClaimsPrincipal principal &&
+                              principal.HasClaim(Claims.GivenName) && principal.HasClaim(Claims.FamilyName)
+                         => $"{principal.GetClaim(Claims.GivenName)} {principal.GetClaim(Claims.FamilyName)}",
+
                     // Mailchimp returns the username as a custom "accountname" node:
                     ProviderTypes.Mailchimp => (string?) context.UserInfoResponse?["accountname"],
 
@@ -1679,6 +1687,20 @@ public static partial class OpenIddictClientWebIntegrationHandlers
                 }
             }
 
+            // Note: ID Austria doesn't return a stable "sub" claim and encourages clients to use
+            // the custom "urn:pvpgvat:oidc.bpk" claim to identify users across logins. To ensure
+            // the WS-Federation name identifier claim returned to the application is stable,
+            // the "urn:pvpgvat:oidc.bpk" claim is always used instead of the "sub" claim.
+            //
+            // For more information, see
+            // https://www.id-austria.gv.at/de/developer/anbinden/anbindung-mit-openid-connect.
+            if (context.Registration.ProviderType is ProviderTypes.IdAustria)
+            {
+                context.MergedPrincipal.SetClaim(ClaimTypes.NameIdentifier,
+                    context.BackchannelIdentityTokenPrincipal?.GetClaim("urn:pvpgvat:oidc.bpk") ??
+                    context.FrontchannelIdentityTokenPrincipal?.GetClaim("urn:pvpgvat:oidc.bpk"));
+            }
+
             return ValueTask.CompletedTask;
         }
     }

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationProviders.xml

@@ -1225,6 +1225,31 @@
     </Environment>
   </Provider>
 
+  <!--
+                                     ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
+                                     █▄ ▄██ ▄▄▀███ ▄▄▀██ ██ ██ ▄▄▄ █▄▄ ▄▄██ ▄▄▀█▄ ▄█ ▄▄▀██
+                                     ██ ███ ██ ███ ▀▀ ██ ██ ██▄▄▄▀▀███ ████ ▀▀▄██ ██ ▀▀ ██
+                                     █▀ ▀██ ▀▀ ███ ██ ██▄▀▀▄██ ▀▀▀ ███ ████ ██ █▀ ▀█ ██ ██
+                                     ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
+  -->
+  
+  <Provider Name="IdAustria" DisplayName="ID Austria" Id="3d66449c-ce7b-46cf-b2f2-6c1fb81bb5fd"
+            Documentation="https://www.id-austria.gv.at/de/developer/anbinden/anbindung-mit-openid-connect">
+    <!--
+      Note: the profile scope is not technically required, but the documentation strongly suggests using it:
+      when it is not requested, ID Austria doesn't return any useful claims, including the vendor-specific
+      "urn:pvpgvat:oidc.bpk" claim needed as substitute for the non-stable "sub" claim returned by ID Austria.
+    -->
+
+    <Environment Name="Production" Issuer="https://idp.id-austria.gv.at/">
+      <Scope Name="profile" Default="true" Required="true"/>
+    </Environment>
+
+    <Environment Name="Reference" Issuer="https://idp.ref.id-austria.gv.at/">
+      <Scope Name="profile" Default="true" Required="true"/>
+    </Environment>
+  </Provider>
+
   <!--
                                   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                                   █████ ██ ██ ██ ▄▀▄ ██ ▄▄ ██ ▄▄▀██ █████ ▄▄▄ ██ ██ ██ ▄▄▀██