Merge branch '16171-oidc'

refs #16171

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>

diff --combined lib/config/config.default.yml
index 29418baa670666208fc9c64404ef6b8048bc0b73,ff73c6f469cbb1c24c09ceb07f8b9a5b644d1ad8..219f6ef0ba91a1afb2e3311ca66b94f5a989020f
--- 1/lib/config/config.default.yml
--- 2/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@@ -551,6 -551,24 +551,24 @@@ Clusters
          # work. If false, only the primary email address will be used.
          AlternateEmailAddresses: true
  
+       OpenIDConnect:
+         # Authenticate with an OpenID Connect provider.
+         Enable: false
+ 
+         # Issuer URL, e.g., "https://login.example.com".
+         #
+         # This must be exactly equal to the URL returned by the issuer
+         # itself in its config response ("isser" key). If the
+         # configured value is "https://example" and the provider
+         # returns "https://example:443" or "https://example/" then
+         # login will fail, even though those URLs are equivalent
+         # (RFC3986).
+         Issuer: ""
+ 
+         # Your client ID and client secret (supplied by the provider).
+         ClientID: ""
+         ClientSecret: ""
+ 
        PAM:
          # (Experimental) Use PAM to authenticate users.
          Enable: false
@@@ -614,15 -632,9 +632,15 @@@
          # "ou=Users,dc=example,dc=com"
          SearchBase: ""
  
 -        # Additional filters for username lookup. Special characters
 -        # in assertion values must be escaped (see RFC4515). Example:
 -        # "(objectClass=person)"
 +        # Additional filters to apply when looking up users' LDAP
 +        # entries. This can be used to restrict access to a subset of
 +        # LDAP users, or to disambiguate users from other directory
 +        # entries that have the SearchAttribute present.
 +        #
 +        # Special characters in assertion values must be escaped (see
 +        # RFC4515).
 +        #
 +        # Example: "(objectClass=person)"
          SearchFilters: ""
  
          # LDAP attribute to use as the user's email address.

diff --combined lib/config/generated_config.go
index 6a4ced7c6ea9776e0cb3f6fd92b052eb3637ddbd,3a317af88ed81f27130f75626be7fe06773c9058..6f8cab462bce2dc15118f31454b40bb35d06e3ff
--- 1/lib/config/generated_config.go
--- 2/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@@ -557,6 -557,24 +557,24 @@@ Clusters
          # work. If false, only the primary email address will be used.
          AlternateEmailAddresses: true
  
+       OpenIDConnect:
+         # Authenticate with an OpenID Connect provider.
+         Enable: false
+ 
+         # Issuer URL, e.g., "https://login.example.com".
+         #
+         # This must be exactly equal to the URL returned by the issuer
+         # itself in its config response ("isser" key). If the
+         # configured value is "https://example" and the provider
+         # returns "https://example:443" or "https://example/" then
+         # login will fail, even though those URLs are equivalent
+         # (RFC3986).
+         Issuer: ""
+ 
+         # Your client ID and client secret (supplied by the provider).
+         ClientID: ""
+         ClientSecret: ""
+ 
        PAM:
          # (Experimental) Use PAM to authenticate users.
          Enable: false
@@@ -620,15 -638,9 +638,15 @@@
          # "ou=Users,dc=example,dc=com"
          SearchBase: ""
  
 -        # Additional filters for username lookup. Special characters
 -        # in assertion values must be escaped (see RFC4515). Example:
 -        # "(objectClass=person)"
 +        # Additional filters to apply when looking up users' LDAP
 +        # entries. This can be used to restrict access to a subset of
 +        # LDAP users, or to disambiguate users from other directory
 +        # entries that have the SearchAttribute present.
 +        #
 +        # Special characters in assertion values must be escaped (see
 +        # RFC4515).
 +        #
 +        # Example: "(objectClass=person)"
          SearchFilters: ""
  
          # LDAP attribute to use as the user's email address.