Allow extra metadata from Single Sign On

[AdamCapriola]

@timoroso

Also, it would be nice to be able to set user groups on first login. What I do now is to set them via API in an SSO login script, but this only works for the users that already exist in Discourse, i.e. users that have already logged in at least once.

You can get around this by setting a delay on the API call (i.e. wait 20 seconds before syncing permissions). That ensures the user will have an account created before you try to map their groups.