feat: Close security gaps OIDC implementation to make it work with Okta

[02strich]

The OIDC implementation in Kargo is a good starting point with using PKCE and looking to leverage latest security practices. Unfortunately, it still has some issues that make it incompatible with some providers, e.g. Okta. This PR adds usage of the state variable to add a further data point around call validation, and removes the offline_access forced scope as both are considered security requirements by Okta. Neither should create issues for existing customers as state usage is standards-compliant (and quite common) and the removed scope can be re-added in configuration.

Does that seem reasonable?

[netlify]

✅ Deploy Preview for docs-kargo-io canceled.

Name	Link
🔨 Latest commit	f415100
🔍 Latest deploy log	https://app.netlify.com/sites/docs-kargo-io/deploys/6732dba00971d800084bffab

[krancour]

We can take a look at this, but it may be a while.

My initial instinct is to avoid this sort of change. Part of the reason we ship with the option to integrate Dex is that it easily corrects for incompatibilities of this nature. For instance, some IDPs don't (yet) support PKCE. Others, like GitHub, don't support OIDC at all. With Dex, resolving these things is a matter of a little configuration instead of code changes.

[02strich]

@krancour happy to wait! In general

I would agree with you, though both changes I am making in this PR are security things that Okta just happens to enforce, while the standard just strongly recommends them. I believe they close issues with the implementation as is (I would expect even using it with Dex). Let me know what you think once you have time to look at it!

[krancour]

offline_access wasn't meant to be forced. The UI is doing it accidentally. The CLI does not. There's a separate issue open regarding that: #3005

The desired behavior is for it to be requested conditionally if the provider supports it. I believe @marvin is already working on that.

I think that leaves just this to grapple with:

This PR adds usage of the state variable to add a further data point around call validation

I need to research this a bit more. As PKCE extends the authorization code flow, that would seem to imply all IDPs that support PKCE should be able to support PKCE with the optional use of state, but I'm hesitant to take that for granted. Let me poke around a few IDPs that I know Kargo already works well with without Dex as a middle-man and verify that they can indeed handle this.

[Marvin9]

Something (or I think exact similar) related to this had been done in ArgoCD - argoproj/argo-cd#17235 @krancour

[krancour]

Thanks @Marvin9!