[RFE] Support OpenID-Connect/OAuth2

[chessbyte]

• Add support for OpenID-Connect/OAuth2 in the API via Ruby
• Add support for OIDCProviderTokenEndpoint, OIDCOAuthIntrospectionEndpoint and OIDCScope in the API via Ruby
• Move API OpenID-Connect/OAuth2 support from API to ManageIQ authenticator
• Research moving API OpenID-Connect/OAuth2 support into Apache configuration
• Debug why the CSRF token support, added by this PR and PR, used by the UI is not working.
• Appliance console changes
• Appliance Console dependency update
• Documentation
• Related Operator Changes
• Enhance API system token authentication to support OIDC
• Enhance Service UI to work with OIDC

Operator Specific Issues

• Do not expose password in CR
• enableApplicationLocalLogin should prevent admin user via API
• Users need to be able to provide trusted CA certs for the OIDC server
• Create an initial group when using external auth - PR being reviewed
• Fetch the OIDC introspection endpoint on deploy

[jvlcek]

Currently there is one blocking issue and two follow on issues needed to fully support this issue.

The blocking issue is to debug why the CSFR token support, added by these PRs [1], used by the UI is not working. Currently my top priority.

The two follow on issue are:

• Adding support for Resource Owner password grants to mod-auth-oidc configuration. This will add support for basic (username:password) authentication. Not needed today but nice to have.

• Adding support for region to region system tokens.

[1] ManageIQ/manageiq-api#543 & ManageIQ/manageiq-appliance#224

[jvlcek]

Update:

The blocking issue, the needed CSRF support is now working.

[chessbyte]

When you get a chance, can you explain what the root cause and solution are to the CSRF issue that is now working

[jvlcek]

It seems it was always working. Late last evening when I was testing it my testing had fatigue induced errors.
Today I restarted everything including the browser used to hit our UI and the CSRF support worked fine.

[jvlcek]

Here is the Issue to address the Region and System token support

ManageIQ/manageiq-api-client#91

[Fryguy]

@jvlcek There are a handful of unchecked things in the original post...are those still valid?

[jvlcek]

@jvlcek There are a handful of unchecked things in the original post...are those still valid?

Yes. Those are add ons not required for basic functionality. I will address them next.

[jvlcek]

Here is the issue to track updating the documentation
ManageIQ/manageiq-documentation#1443

[chessbyte]

Removed Lower Priority Items from checklist in OP. Moved them here so that they are easy to find in the future.

• Add support for JWT authentication in API Client
• Add support for the OIDCScope configuration parameter
• Add support for OIDC Resource Owner password grants

[abellotti]

Fetch the OIDC Introspection Endpoint on Deploy: ManageIQ/manageiq-pods#582