feat: Allow multiple values for SSO attribute_requirements via comma separation

[meise]

In the current attribute_requirements implementation it is only possible to allow exact matching attribute values. Multiple allowed values for one attribute are not possible as described in #13238.

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct
  (run the linters)

[CLAassistant]

All committers have signed the CLA.

[meise]

I'm not sure whether the current change is really ideal or whether the JSON schema should be changed to a value list.

[sandhose]

I assume this is because it was vailing if value or one_of is missing? I think this is because they should have explicitly None as default, e.g. value: Optional[str] = None

[pizkaz]

Indeed. I will try using default values, as you suggested.

[pizkaz]

Works like a charm. Thanks for pointing in the right direction. 🙂

[sandhose]

Is that right? Does that mean that either value or one_of must be set? I thought it was possible to have neither of them set?

[pizkaz]

Yes, either value or one_of must be set. Before these changes, the JSON schema had value listed as required as well.
As far as I understand, value can be None, though. There is, however, no test case ensuring this. If you want I can implement one.

[sandhose]

Noted; a test would indeed be helpful!

[pizkaz]

Whoa, this is confusing. The comment

    # If a value is not given, than the attribute must simply exist.
    value: Optional[str]

is and has been a lie since 6dade80, except for CAS, which uses a different JSON schema and thus bypasses the required rule a few lines below:

        "required": ["attribute", "value"],

I updated the comment, so people don't need to find this out the hard way, as I did. 😉

A CAS test without a value already exists.