feat(oidc): add oidc support

[jindraj]

Notes

The OIDC applications need to be setup in advance

• the callback for application is application url /callback. e.g. https://example.com/ will have callback url https://example.com/callback

the oidc applications are configured via module's oidc variable - list of objects. Multiple oidc applications can be provided, you can select which provider to authenticate by appending ?auth=PROVIDER_NAME to url

• suggestion: create s3 object /login.html with links <a href=/?auth=PROVIDER_NAME>PROVIDER_NAME and redirect user there if session is missing. Use can pick which application to use for authentication without need to change URL manually.

changes to the original main module:

new resources:

• aws_cloudfront_cache_policy.oidc
• aws_cloudfront_origin_request_policy.oidc

changed blocks:

• custom_error_response in aws_cloudfront_distribution.this is now conditionaly removed if oidc is enabled, to prevent serving content on error
• default_cache_behavior in aws_cloudfront_distribution.this conditionally enables forwarding all cookies if oidc is enabled

added blocks:

• origin for api gateway in aws_cloudfront_distribution.this - dynamically created if oidc is enabled
• lambda_function_association in aws_cloudfront_distribution.this dynamically created if oidc is enabled for edge lambda handling redirects to oidc provider
• ordered_cache_behavior in aws_cloudfront_distribution.this - dynamically created if oidc is enabled, configuring /callback route to point to api gateway origin handling with callbacks

Example

1. Create OIDC app just for the reference, gitlab_application is server wide and not ideal for use e.g. on gitlab.com, there's no support for the group applications

resource "gitlab_application" "fridges_list" {
  name         = "gitlab-app"
  redirect_url = "www.example.com"
  scopes = [
    "openid",
    "read_user",
    "profile",
    "email",
  ]
}

2. use module

module "static_site" {
  source  = "cookielab/static-site/aws"
  version = "4.9.0"

  providers = {
    aws           = aws
    aws.us_east_1 = aws.vir
  }

  domains        = ["www.exmaple.com"]
  domain_zone_id = "aws_route53_zone.example_com.zone_id"
  s3_bucket_name = "example-com-web"

  gitlab_project_id  = data.gitlab_project.app_fridges_list.id
  gitlab_environment = var.environment

  enable_deploy_role = true
  enable_deploy_user = false

  oidc = [
    { # first oidc provider
      application_name = "gitlab"
      application_id   = gitlab_application.gitlab_application.application_id
      client_secret    = gitlab_application.gitlab_application.secret
      auth_url         = "https://gitlab.com/oauth/authorize"
      token_url        = "https://gitlab.com/oauth/token"
    },
    { # second oidc provider
      application_name = "second"
      application_id   = "second-oidc-app-id"
      client_secret    = "second-oidc-client-secret"
      auth_url         = "https://another-oidc-provicer.example.com/oauth/authorize"
      token_url        = "https://another-oidc-provicer.example.com/oauth/token"
    }
  ]

Then https://www.example.com/?auth=APPLICATION_NAME forces auth with specified provider, e.g.:

• https://www.example.com/?auth=gitlab
• https://www.example.com/?auth=second

This is messy. Perhaps we can get along with a single OIDC auth for the application. Or constructed html file from the oidc list, put it on S3 and redirect if no session cookie is present:

<h1>Choose authentication method</h1>
<ul>
  <li>
    <a href="/?auth=gitlab">Gitlab</a>
  </li>
  <li>
    <a href="/?auth=second">Second</a>
  </li>
</ul>

[joli-sys]

LGTM, move OIDC to separate module under aws cloud provider submodule, to have opportunity extend OIDC to different cloud providers in future.

[joli-sys]

List

[joli-sys]

English comments

[joli-sys]

English comments

[joli-sys]

English comments