Delegate OAuth authentication to keycloak

[skabashnyuk]

1. We want to manage Identity Providers like github or google on keyclaok
2. We want to be able to use github or other IP tokens from plugins.
3. We would like to have the same api for Che SDK and multiuser che.
   3.1

    @GET
    @Path("authenticate")
    public Response authenticate(@Required @QueryParam("oauth_provider") String oauthProvider,
                                 @QueryParam("scope") List<String> scopes)throws ForbiddenException,
                                                                                 BadRequestException,
                                                                                 OAuthAuthenticationException {

to initiate authentification on IP.
3.2

   @GET
   @Path("token")
   @Produces(MediaType.APPLICATION_JSON)
   public OAuthToken token(@Required @QueryParam("oauth_provider") String oauthProvider)

To get stored token for IP.

See more
https://wjw465150.gitbooks.io/keycloak-documentation/server_admin/topics/identity-broker/tokens.html

[l0rd]

@skabashnyuk do you expect us (che-osio team) to work on that issue or are you going to implement it?
cc @ibuziuk @davidfestal @sunix

[skabashnyuk]

@l0rd Yes. I'm planning to work on it during next sprint

[skabashnyuk]

Notes from meeting with @l0rd and @davidfestal

End user goal:
Use Keyclaok account linking feature for two purposes.

1. Identity Brokering. Keycloak can delegate authentication to a parent IDP for login. A typical example of this is the case where you want users to be able to login through a social provider like Facebook or Google. Keycloak also allows you to link existing accounts to a brokered IDP. http://www.keycloak.org/docs/3.3/server_development/topics/identity-brokering.html
2. Retrieving External IDP Tokens. For github operation for example. http://www.keycloak.org/docs/3.3/server_development/topics/identity-brokering/tokens.html

During development, I've met a couple of issues.
A. Client Initiated Account Linking http://www.keycloak.org/docs/3.3/server_development/topics/identity-brokering/account-linking.html
Have to be started in a separate frame. (Because some IP do not allow to use iframe like Google). The problem here is there is no
way to send Keycloak token as a header.
B. During some operation on ws-agent server side, we need to request oauth tokens from the master. To be able to authenticate
agent on master we use machine tokens (per user per workspace token). I didn't find a way how properly(easily) transform machine token to keycloak token.
Keycloak tokens are short live tokens, it has to be refreshed all the time. Hurd to handle refresh errors.
C. We probably may have problems with Oauth scopes because 1 and [2](IP operation) may have different scopes. For example login with github and upload ssh keys.

Decided.
A. Use query parameter to send keycloak token. We decided the same for javadocs. Use OAuth subsystem as it is now. #6300
B.C. Since it might require some time for investigation and(or) refactoring. We decided to remove this a requirement for the first release.

[mshaposhnik]

Adding screenshots of KK OAuth & permissions configuration: