[DDO-3785] OIDC

[jack-r-warren]

• Implements OIDC for "authorization service" usage, with /oidc as the issuer and /login as the "login" page that just validates auth requests based on middleware
• Adds configuration option to have Sherlock never report an empty/null RequiredRole and instead default to a static string. This is a request from appsec as its easier to have downstream consumers use it verbatim than say that they properly implement some logic like environment.requiredRole ?? "all-users"

Testing

I've added tests for our implementation of the OIDC library we're using and the login page. Appsec has tested this in concert with ArgoCD and it got the thumb from them.

Risk

Low at this point due to testing.

[github-actions]

No API changes detected

[github-actions]

Published image from 8a6f023 (merge deccad2):

us-central1-docker.pkg.dev/dsp-artifact-registry/sherlock/sherlock:v1.5.22-deccad2
us-central1-docker.pkg.dev/dsp-devops-super-prod/sherlock/sherlock:v1.5.22-deccad2

[codecov]

Codecov Report

Attention: Patch coverage is 48.41499% with 358 lines in your changes missing coverage. Please review.

Project coverage is 69.62%. Comparing base (ac76150) to head (8a6f023).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #608      +/-   ##
==========================================
- Coverage   76.26%   69.62%   -6.65%     
==========================================
  Files         211      272      +61     
  Lines       10031    12370    +2339     
==========================================
+ Hits         7650     8612     +962     
- Misses       1704     2880    +1176     
- Partials      677      878     +201     

Files	Coverage Δ
sherlock/internal/api/sherlock/clusters_v3.go	76.47% <100.00%> (+0.96%)	⬆️
sherlock/internal/api/sherlock/environments_v3.go	92.14% <100.00%> (+0.11%)	⬆️
sherlock/internal/config/config.go	29.31% <100.00%> (+1.24%)	⬆️
sherlock/internal/models/user.go	84.15% <100.00%> (ø)
sherlock/internal/boot/application.go	59.34% <66.66%> (+0.37%)	⬆️
...bility_synchronization/suspend_role_assignments.go	62.66% <50.00%> (ø)
sherlock/internal/oidc_models/token.go	33.33% <33.33%> (ø)
sherlock/internal/oidc_models/test_helper.go	82.85% <82.85%> (ø)
sherlock/internal/api/login/login.go	69.56% <69.56%> (ø)
sherlock/internal/boot/router.go	63.63% <46.15%> (-7.80%)	⬇️
... and 7 more

... and 51 files with indirect coverage changes

[sonarqubecloud]

Quality Gate passed

Issues
43 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
7.1% Duplication on New Code

See analysis details on SonarCloud

[mikeflinn]

Non blocking comments, other wise cool stuff.

[mikeflinn]

What is this suite testing?

[jack-r-warren]

handler_test is sorta borrowing the convention from the other (more multi-endpoint) api packages -- this hosts the suite and the other test files (login_test.go here) use it.

[mikeflinn]

I like this pattern is an easily visible compile time validation

[jack-r-warren]

Yeah it's convenient because if you write this as the first step GoLand will offer to generate stubs for all the methods