My situation here is that I want my Salesforce Digital Experience (AKA Community) to use an external identity provider that holds some custom access rights attributes that need to be transferred to Salesforce to influence what the Digital Experience presents. This is the Salesforce as a Service Provider case.
For SAML, it looks like hooking in an implementation of the SamlJitHandler that is passed all of the attributes of the SAML assertion will solve this problem.
But I don't see an equivalent ready to go mechanism for OAUTH. Is there one?
Writing this question I just found this question Any way to get current session SSO information? that has an answer that points to the AuthProviderPluginClass. If you have experience with that do post an answer.