Deny suspended directory identities

src/internal/server/oidc/token.go

@@ -108,6 +108,14 @@ func (h *TokenHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "user not found", http.StatusInternalServerError)
 		return
 	}
+	if isSuspended(user) {
+		h.Sessions.Delete(code)
+		profileerrors.RejectedForSafety(
+			"account is suspended",
+			"account_lifecycle",
+		).Write(w, http.StatusForbidden)
+		return
+	}
 
 	// 6. Build JWT claims.
 	now := time.Now()
@@ -270,6 +278,10 @@ func containsString(values []string, wanted string) bool {
 	return false
 }
 
+func isSuspended(user *domain.User) bool {
+	return containsString(user.Groups, "netkingdom-suspended")
+}
+
 // ---------------------------------------------------------------------------
 // IAM Profile core claims (KEY-WP-0005-T01)
 // ---------------------------------------------------------------------------