Enhance API system token authentication to support OIDC and SAML

[abellotti]

With system token authentication, user authorization works with database authentication as well as authentications where we can query the user for the metadata needed for creating and authorizing the user. i.e.

• Database
• MiqLdap
• External Auth (SSSD based)
  • LDAP
  • AD
  • IPA

For External authentications where we cannot fetch the user metadata on demand, authorization will not work, this includes:

• OIDC
• SAML

While for OIDC, we can enhance the API client to add support for JWT authentication as per ManageIQ/manageiq-api-client#91, this is only for OIDC and will not work from the CloudForms UI where the authentication is via web redirects (OIDC or SAML), so no JWT token is available for the appliance's region-to-region code to leverage.

The proposal here is that for OIDC and SAML based authentications, we extend the X-Miq-Token system token triad to include the current user's metadata. The current user having just been authorized via the external auth system, we have the trusted and latest attributes for them. We can now include :user_metadata as part of the system to token to include the attributes necessary to create or update the user in the receiving region for proper authorization. So the triad would now include:

• :server_guid
• :timestamp
• :userid
• :user_metadata

With :user_metadata being optional where we'd populate for OIDC and SAML authentications.

[abellotti]

@gtanzillo as discussed.

/cc @chessbyte

[abellotti]

Solved by:

• Enhanced API System token authentication to work with OIDC and SAML. #846
• Enhanced system token authorization to work with OIDC and SAML manageiq#20202

[abellotti]

PRs merged, so closing the issue.