Provide OAuth2 compatible identity provider

[danielkelemen]

Acceptance Criteria (Required on creation)

• Implement an identity provider that support both Camunda groups and oauth2 provider groups.
• Use Spring's authorities as oauth2 groups.
  • Provide a config property so it can be customized which claim contains the groups.
• Reuse the DbIdentityServiceProvider.
• Handle groups from both sources according to the define specification.
  • We don't combine grops. If user is coming from Spring security context, we take groups from there, otherwise from DB.
• Tests. Moved to a separate ticket.

Hints

Links

Breakdown

PRs

Beta Give feedback

1. feat(run): add oauth2 identity provider #4570
   ci:default-build ci:distro ci:spring-boot +3
   

[danielkelemen]

Notes

• This PR adds an optional oauth2 identity provider
  • Can be activated with camunda.bpm.oauth2.identity-provider.enabled: true
  • Provider has the common plugin, factory and impl classes
• The provider inherits from the DB writable provider so users can still use DB credentials for the rest api.
• An oauth2 granted authorities mapper is also added. (Spring docs)
  • This is also an optional class that can be used to map authorities from a different claim. Spring uses the scope (scp) by default for authorities.
  • Can be activated with camunda.bpm.oauth2.identity-provider.group-name-attribute: <claim name>