Skipper: support openidc with JWT claim support

[szuecs]

get config

The OIDC config is located at <issuer>/.well-known/openid-configuration.

For example

• authorization_endpoint: oauth2.Config.Endpoint.AuthURL
• token_endpoint: oauth2.Config.Endpoint.TokenURL

One problem is that /.well-known/openid-configuration , is not mandatory returning the introspection_endpoint by https://tools.ietf.org/html/draft-ietf-oauth-discovery-06 (marked as OPTIONAL ).

Example call to introspection_endpoint, it has to support POST by https://tools.ietf.org/html/rfc7662

% curl -X POST -d "token=$(ztoken)" localhost:9021/oauth2/introspect

Google

{ 
  "issuer": "https://accounts.google.com",
  "authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",
  "token_endpoint": "https://www.googleapis.com/oauth2/v4/token",
  "userinfo_endpoint": "https://www.googleapis.com/oauth2/v3/userinfo",
  "revocation_endpoint": "https://accounts.google.com/o/oauth2/revoke",
  "jwks_uri": "https://www.googleapis.com/oauth2/v3/certs",
  "response_types_supported": [
    "code",
    "token",
    "id_token",
    "code token",
    "code id_token",
    "token id_token",
    "code token id_token",
    "none"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "profile"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "claims_supported": [
    "aud",
    "email",
    "email_verified",
    "exp",
    "family_name",
    "given_name",
    "iat",
    "iss",
    "locale",
    "name",
    "picture",
    "sub"
  ],
  "code_challenge_methods_supported": [
    "plain",
    "S256"
  ]
}

Zalando

{
  "issuer": "https://identity.zalando.com",
  "authorization_endpoint": "https://identity.zalando.com/oauth2/authorize",
  "token_endpoint": "https://identity.zalando.com/oauth2/token",
  "revocation_endpoint": "https://identity.zalando.com/oauth2/revoke",
  "jwks_uri": "https://identity.zalando.com/.well-known/jwk_uris",
  "response_types_supported": [
    "token",
    "code token"
  ],
  "subject_types_supported": [
    "public"
  ],
  "registration_endpoint": "https://identity.zalando.com/oauth2/register",
  "id_token_signing_alg_values_supported": [
    "RS256",
    "RS384",
    "RS512",
    "PS256",
    "PS384",
    "PS512",
    "ES256",
    "ES384",
    "ES512"
  ],
  "claims_supported": [
    "sub",
    "azp",
    "iss",
    "exp",
    "iat",
    "https://identity.zalando.com/token",
    "https://identity.zalando.com/realm",
    "https://identity.zalando.com/bp",
    "https://identity.zalando.com/privileges"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic"
  ]
}

[szuecs]

started to build this in branch feature/oauth2-introspection

[szuecs]

Tokenintrospection for svc-to-svc was done, but the OpenIDConnect part was skipped. The new PR is https://github.com/zalando/skipper/pull/743 for the OpenIDConnect feature that support authcode flow for easy to use UI integrations.