Merge branch '15529-federated-user-accounts' refs #15529

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>

diff --combined lib/config/config.default.yml
index 24b2e450eb8c927388ec5add94299fb931163ccf,3338bec511641d03d5b8e9aea458d5a781814e8e..c7a038bec6c5da05fbeef993acae2f31ff7197b9
--- 1/lib/config/config.default.yml
--- 2/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@@ -206,9 -206,6 +206,9 @@@ Clusters
        WebsocketClientEventQueue: 64
        WebsocketServerEventQueue: 4
  
 +      # Timeout on requests to internal Keep services.
 +      KeepServiceRequestTimeout: 15s
 +
      Users:
        # Config parameters to automatically setup new users.  If enabled,
        # this users will be able to self-activate.  Enable this if you want
@@@ -413,23 -410,21 +413,32 @@@
          MaxUUIDEntries:       1000
  
      Login:
-       # These settings are provided by your OAuth2 provider (e.g.,
-       # sso-provider).
+       # These settings are provided by your OAuth2 provider (eg
+       # Google) used to perform upstream authentication.
        ProviderAppSecret: ""
        ProviderAppID: ""
  
+       # The cluster ID to delegate the user database.  When set,
+       # logins on this cluster will be redirected to the login cluster
+       # (login cluster must appear in RemoteHosts with Proxy: true)
+       LoginCluster: ""
+ 
+       # How long a cached token belonging to a remote cluster will
+       # remain valid before it needs to be revalidated.
+       RemoteTokenRefresh: 5m
+ 
      Git:
 +      # Path to git or gitolite-shell executable. Each authenticated
 +      # request will execute this program with the single argument "http-backend"
 +      GitCommand: /usr/bin/git
 +
 +      # Path to Gitolite's home directory. If a non-empty path is given,
 +      # the CGI environment will be set up to support the use of
 +      # gitolite-shell as a GitCommand: for example, if GitoliteHome is
 +      # "/gh", then the CGI environment will have GITOLITE_HTTP_HOME=/gh,
 +      # PATH=$PATH:/gh/bin, and GL_BYPASS_ACCESS_CHECKS=1.
 +      GitoliteHome: ""
 +
        # Git repositories must be readable by api server, or you won't be
        # able to submit crunch jobs. To pass the test suites, put a clone
        # of the arvados tree in {git_repositories_dir}/arvados.git or

diff --combined lib/config/export.go
index 6eb4fbe5f570d4abf9ffd885f1ab0d822acf7fa2,ffeb527c9487e14ebe1bae6a84a977db91d9101e..69aae2c624a68ed4fcf5837739e33e3d97fc30e7
--- 1/lib/config/export.go
--- 2/lib/config/export.go
+++ b/lib/config/export.go
@@@ -72,7 -72,6 +72,7 @@@ var whitelist = map[string]bool
        "API.WebsocketClientEventQueue":                false,
        "API.SendTimeout":                              true,
        "API.WebsocketServerEventQueue":                false,
 +      "API.KeepServiceRequestTimeout":                false,
        "AuditLogs":                                    false,
        "AuditLogs.MaxAge":                             false,
        "AuditLogs.MaxDeleteBatch":                     false,
@@@ -117,7 -116,11 +117,11 @@@
        "InstanceTypes":                                true,
        "InstanceTypes.*":                              true,
        "InstanceTypes.*.*":                            true,
-       "Login":                                        false,
+       "Login":                                        true,
+       "Login.ProviderAppSecret":                      false,
+       "Login.ProviderAppID":                          false,
+       "Login.LoginCluster":                           true,
+       "Login.RemoteTokenRefresh":                     true,
        "Mail":                                         false,
        "ManagementToken":                              false,
        "PostgreSQL":                                   false,

diff --combined lib/config/generated_config.go
index 8a5b4610c2b9b3ec88dd7029eed52bc7de4ce704,ce1d8a1ed8185ba9e94e6e53ddf3708993796b4d..f8a0e097dc7d4e3f9de577d747cd9c0b54a87d0b
--- 1/lib/config/generated_config.go
--- 2/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@@ -212,9 -212,6 +212,9 @@@ Clusters
        WebsocketClientEventQueue: 64
        WebsocketServerEventQueue: 4
  
 +      # Timeout on requests to internal Keep services.
 +      KeepServiceRequestTimeout: 15s
 +
      Users:
        # Config parameters to automatically setup new users.  If enabled,
        # this users will be able to self-activate.  Enable this if you want
@@@ -419,23 -416,21 +419,32 @@@
          MaxUUIDEntries:       1000
  
      Login:
-       # These settings are provided by your OAuth2 provider (e.g.,
-       # sso-provider).
+       # These settings are provided by your OAuth2 provider (eg
+       # Google) used to perform upstream authentication.
        ProviderAppSecret: ""
        ProviderAppID: ""
  
+       # The cluster ID to delegate the user database.  When set,
+       # logins on this cluster will be redirected to the login cluster
+       # (login cluster must appear in RemoteHosts with Proxy: true)
+       LoginCluster: ""
+ 
+       # How long a cached token belonging to a remote cluster will
+       # remain valid before it needs to be revalidated.
+       RemoteTokenRefresh: 5m
+ 
      Git:
 +      # Path to git or gitolite-shell executable. Each authenticated
 +      # request will execute this program with the single argument "http-backend"
 +      GitCommand: /usr/bin/git
 +
 +      # Path to Gitolite's home directory. If a non-empty path is given,
 +      # the CGI environment will be set up to support the use of
 +      # gitolite-shell as a GitCommand: for example, if GitoliteHome is
 +      # "/gh", then the CGI environment will have GITOLITE_HTTP_HOME=/gh,
 +      # PATH=$PATH:/gh/bin, and GL_BYPASS_ACCESS_CHECKS=1.
 +      GitoliteHome: ""
 +
        # Git repositories must be readable by api server, or you won't be
        # able to submit crunch jobs. To pass the test suites, put a clone
        # of the arvados tree in {git_repositories_dir}/arvados.git or

diff --combined sdk/go/arvados/config.go
index 5a18972f5232127466a1590c023915deef354935,fdb3293a671ed18917b2b2a24da4fa5f2d459e3d..29dd62ac1eb2ca3f0c224bd08033284451f45c05
--- 1/sdk/go/arvados/config.go
--- 2/sdk/go/arvados/config.go
+++ b/sdk/go/arvados/config.go
@@@ -88,7 -88,6 +88,7 @@@ type Cluster struct 
                SendTimeout                    Duration
                WebsocketClientEventQueue      int
                WebsocketServerEventQueue      int
 +              KeepServiceRequestTimeout      Duration
        }
        AuditLogs struct {
                MaxAge             Duration
@@@ -114,13 -113,13 +114,15 @@@
                WebDAVCache WebDAVCacheConfig
        }
        Git struct {
 +              GitCommand   string
 +              GitoliteHome string
                Repositories string
        }
        Login struct {
-               ProviderAppSecret string
-               ProviderAppID     string
+               ProviderAppSecret  string
+               ProviderAppID      string
+               LoginCluster       string
+               RemoteTokenRefresh Duration
        }
        Mail struct {
                MailchimpAPIKey                string