[DUOS-2873][risk=no] Cache request headers and populate auth user with them

[rushtong]

Addresses

https://broadworkbench.atlassian.net/browse/DUOS-2873

Summary

This PR replaces the current Google token lookup to retrieve user information in favor of using incoming OAUTH2_CLAIM headers.

• Add a request filter that caches all OAUTH2_CLAIM_* request headers in a map of bearer token -> header map
• Make the cache available to OAuthAuthenticator which only has access to a bearer token
• Populate the AuthUser with values from the claims.
• OAuthAuthenticator does not need to actually validate the token, that has happened already in the proxy
• Remove unnecessary GenericUser and all usages thereof.

Notes

Our proxy populates a number of OAUTH2_CLAIM headers depending on the login choices. This info is enough to populate the AuthUser used throughout the app. Examples used in testing:

OAUTH Claims

Google Sign In:
	OAUTH2_CLAIM_email=[email],
	OAUTH2_CLAIM_active=[boolean],
	OAUTH2_CLAIM_sub=[google subject id],
	OAUTH2_CLAIM_token_type=[bearer],
	OAUTH2_CLAIM_scope=[scopes],
	OAUTH2_CLAIM_aud=[google client id],
	OAUTH2_CLAIM_exp=[number],
	OAUTH2_CLAIM_username=[email],
	OAUTH2_CLAIM_access_token=[token string],

OIDC -> Google Sign In:

	OAUTH2_CLAIM_email_verified=[boolean],
	OAUTH2_CLAIM_email=[string],
	OAUTH2_CLAIM_sub=[uuid],
	OAUTH2_CLAIM_aud=[uuid],
	OAUTH2_CLAIM_nbf=[number],
	OAUTH2_CLAIM_name=[full name],
	OAUTH2_CLAIM_idp=[google.com],
	OAUTH2_CLAIM_family_name=[last name],
	OAUTH2_CLAIM_azp=[uuid],
	OAUTH2_CLAIM_iat=[number],
	OAUTH2_CLAIM_exp=[number],
	OAUTH2_CLAIM_ver=[1.0],
	OAUTH2_CLAIM_google_id=[google subject id],
	OAUTH2_CLAIM_given_name=[first name],
	OAUTH2_CLAIM_iss=[https://terradevb2c.b2clogin.com/...],
	OAUTH2_CLAIM_picture=[https://lh3.googleusercontent.com/...],
	OAUTH2_CLAIM_tid=[uuid],
	OAUTH2_CLAIM_access_token=[token string],

OIDC -> Microsoft Login:

	OAUTH2_CLAIM_email_verified=[boolean], 
	OAUTH2_CLAIM_email=[string], 
	OAUTH2_CLAIM_isAzurePreviewUser=[false], 
	OAUTH2_CLAIM_sub=[uuid], 
	OAUTH2_CLAIM_aud=[uuid], 
	OAUTH2_CLAIM_nbf=[number], 
	OAUTH2_CLAIM_name=[full name], 
	OAUTH2_CLAIM_idp=[https://login.microsoftonline.com/...], 
	OAUTH2_CLAIM_azp=[uuid], 
	OAUTH2_CLAIM_iat=[number], 
	OAUTH2_CLAIM_exp=[number], 
	OAUTH2_CLAIM_ver=[1.0], 
	OAUTH2_CLAIM_iss=[https://terradevb2c.b2clogin.com/...], 
	OAUTH2_CLAIM_tid=[uuid], 
	OAUTH2_CLAIM_access_token=[token string],

Testing

To test, run this branch locally:

• Google Sign In
  • The standard swagger login works unchanged so you can test standard usage that uses Google Sign In to generate a bearer token
• OIDC -> Google Sign In
  • Log into Sam using OIDC, then choose Google to complete the auth dance. Execute any API call and copy the bearer token for use in a curl call.
  • Execute curl -X 'GET' 'https://local.broadinstitute.org:27443/api/user/me' -H 'accept: application/json' -H 'Authorization: <copied token>'
• OIDC -> Microsoft Login
  • Requires an account with Microsoft. One can either create a new account there or link a google account to Microsoft - both approaches work.
  • Log into Sam using OIDC, then choose Microsoft to complete the auth dance. Execute any API call and copy the bearer token for use in a curl call.
  • Execute curl -X 'GET' 'https://local.broadinstitute.org:27443/api/user/me' -H 'accept: application/json' -H 'Authorization: <copied token>'

---

Have you read CONTRIBUTING.md lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

[aarohinadkarni]

👍

[fboulnois]

💯 👍