add generic OIDC auth backend

[mrshmllow]

closes #195

This is a very simple wrapper around the Buildbot OAuth2Auth class that you can configure with new options.

Additionally, you can set your own scope and map the claims, if your OIDC provider changes them in some way. It supports syncing groups although you need to include that scope and mapping yourself.

So far I've tested this successfully with PocketID.

As a note: I decided to identify users by the provider's preferred_username because it works well with the admins option

[mrshmllow]

I wonder if adding new admins alongside the normal admins option with groups would be a good addition here?

[Mic92]

@MagicRB are we able to test this in numtide infra? For my own buildbot the issue might be that I have people that want to login when having access to a nix-community repo.

[mrshmllow]

You can test the python-side of this with a mock server as well

$ echo "abc" > /tmp/client_secret && nix run nixpkgs#pipx -- run oidc-provider-mock --user-claims '{"sub": "alice", "email": "alice@example.com", "name": "Alice", "preferred_username": "alice123"}'

tree diff

diff --git a/packages/master.cfg.py b/packages/master.cfg.py
index 8cf3db1..2d91c50 100644
--- a/packages/master.cfg.py
+++ b/packages/master.cfg.py
@@ -3,13 +3,18 @@ from buildbot_nix import (
     NixConfigurator,
     BuildbotNixConfig,
 )
-from buildbot_nix.models import PullBasedConfig, PullBasedRepository
+from buildbot_nix.models import (
+    PullBasedConfig,
+    PullBasedRepository,
+    OIDCConfig,
+    AuthBackendConfig,
+    OIDCMappingConfig,
+)
 import getpass
 import os
 import platform
 import subprocess
 import multiprocessing
-from buildbot.plugins import util
 from buildbot.process.factory import BuildFactory
 from dataclasses import dataclass

@@ -211,6 +216,17 @@ buildbot_nix_config = BuildbotNixConfig(
     url=url,
     gcroots_user=getpass.getuser(),
     admins=["admin"],
+    auth_backend=AuthBackendConfig.oidc,
+    oidc=OIDCConfig(
+        name="Mock",
+        discovery_url="http://localhost:9400/.well-known/openid-configuration",
+        client_id="123",
+        client_secret_file="/tmp/client_secret",
+        scope=["openid", "email", "profile"],
+        mapping=OIDCMappingConfig(
+            email="email", username="preferred_username", full_name="name", groups=None
+        ),
+    ),
 )

 c = BuildmasterConfig = dict(
@@ -221,5 +237,5 @@ c = BuildmasterConfig = dict(
         NixConfigurator(buildbot_nix_config),
     ],
     protocols={"pb": {"port": "tcp:9989:interface=\\:\\:1"}},
-    www=dict(port=PORT, plugins=dict(), auth=util.UserPasswordAuth({"admin": "admin"})),
+    www=dict(port=PORT, plugins=dict()),
 )

I also run this PR on https://buildbot.althaea.zone/ but you wouldn't be able to login

[Mic92]

@mrshmllow can you please check? I added documentation and tested the code, you gave me locally.