Description

• What is being changed?
  Controller 2.4 defaulted to using the social_auth library defaults of [RS256].
  Additionally, as an enhancement, we will first attempt to pull the keys from the providers .well-know configuration. If that fails for any reason we will go back to the library defaults.

• Why is this change needed?
  In gateway we did not default to values from the library, the admin has to enter the values. This is painful and not inline with the controller defaults.

• How does this change address the issue?
  See what is being changed.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Test update
• Refactoring (no functional changes)
• Development environment change
• Configuration change

Self-Review Checklist

• I have performed a self-review of my code
• I have added relevant comments to complex code sections
• I have updated documentation where needed
• I have considered the security impact of these changes
• I have considered performance implications
• I have thought about error handling and edge cases
• I have tested the changes in my local environment

Testing Instructions

Prerequisites

Steps to Test

1. Have ATF create you an authenticator. In test-suite create a test method like:

    def test_plumb_oidc(
        self,
        api_registry: APIRegistry,
        app: AnsibleAutomationPlatformTestingApplication,
        factories: Factories,
        keycloak_service_saml_oidc: HttpApiService,
    ) -> None:
        """When expected attributes for mapping are missing from the identity provider,
        an error is logged but authentication is handled gracefully.
        """
        oidc_authenticator = (
            api_registry.gateway.authenticator.list_resource(
                type_icontains=TypeEnum.ANSIBLE_BASE_AUTHENTICATION_AUTHENTICATOR_PLUGINS_OIDC
            )
            .assert_and_get()
            .results.pop()
        )
        breakpoint()

2. Run the test. When you hit the breakpoint whatever environment you pointed this to will now have a "Generic OIDC" authenticator in it.
3. Manipulate the keycloak and authenticator however you want and test logins.
4. You can also use breakpoints in the gateway code to enable debugging.

Expected Results

Additional Context

Required Actions

• Requires documentation updates
• Requires downstream repository changes
• Requires infrastructure/deployment changes
• Requires coordination with other teams
• Blocked by PR/MR: #XXX

Screenshots/Logs