Add generic OIDC authentication flow

[palash247]

What type of PR is this?

• Refactor
• Feature
• Bug Fix
• New Query Runner (Data Source)
• New Alert Destination
• Other

Description

Generic OIDC login

Note: Seeking feedback

Problem

Currently, Redash is limited to supporting authentication via Google's OIDC. Expanding the authentication support to a generic OIDC flow increases Redash's accessibility and flexibility, making it a more inclusive tool for diverse environments.

Implementation Steps

To fully implement and integrate the generic OIDC authentication flow into Redash, the following steps need to be taken (Open for feedback):

• Make OIDC Discovery Endpoint Configurable: This flexibility allows Redash to dynamically adapt to different IdPs by simply modifying configuration parameters.

• Implement Routes for OIDC Authentication: Develop new routes within the application to handle the authentication process via OIDC.

• Modify Login Templates: Update the UI components, specifically the login page templates, to include an OIDC login button.

• Manual Testing with Multiple OIDC IdPs: To ensure compatibility and robustness, manually test the new authentication flow with multiple OIDC IdPs, including but not limited to Google, AWS, Okta, and Auth0. (Tested with Google and AWS Cognito)

• Implement Unit Tests

• Write Documentation for OIDC Configuration: Create detailed documentation to assist users in configuring OIDC with Redash. This documentation should cover configuration steps for different IdPs.

• Mutate OIDC to include domain check: (not sure about this one) Current Google OIDC flow has domain verification, see if this can be made generic.

• Replace Google OIDC with generic one

How is this tested?

• Unit tests (pytest, jest)
• E2E Tests (Cypress)
• Manually
• N/A

For testing manually, following steps should be more are less common among different IdPs.

1. Configure an IdP with OIDC federation protocol and get the discovery endpoint, client id and secret id.
2. Set 3 environment variables accordingly:

• REDASH_OIDC_CLIENT_ID
• REDASH_OIDC_CLIENT_SECRET
• REDASH_OIDC_ISSUER_URL

3. Check if Login with OIDC button available in the login page.
4. Login

• AWS Cognito
• Google
• Okta
• Auth0
• Azure

Related Tickets & Documents

#6781

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

[codecov]

Codecov Report

Attention: Patch coverage is 25.00000% with 63 lines in your changes are missing coverage. Please review.

Project coverage is 63.17%. Comparing base (af0773c) to head (6649774).
Report is 36 commits behind head on master.

❗ Current head 6649774 differs from pull request most recent head 83650bb. Consider uploading reports for the commit 83650bb to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6783      +/-   ##
==========================================
- Coverage   63.82%   63.17%   -0.65%     
==========================================
  Files         161      164       +3     
  Lines       13060    13285     +225     
  Branches     1803     1834      +31     
==========================================
+ Hits         8335     8393      +58     
- Misses       4425     4592     +167     
  Partials      300      300              

Files	Coverage Δ
redash/authentication/__init__.py	81.53% <100.00%> (+0.19%)	⬆️
redash/settings/__init__.py	98.69% <100.00%> (+0.04%)	⬆️
redash/handlers/authentication.py	71.02% <44.44%> (-2.15%)	⬇️
redash/authentication/oidc.py	13.43% <13.43%> (ø)

... and 9 files with indirect coverage changes

[palash247]

Hi @arikfr,
Can I please get some feedback over the approach?