Move API OpenID-Connect support to Apache configuration

[jvlcek]

Fixes #19866

This PR, combined with others in other github repos, will move the support for the ManageIQ API out of code and into the Apache configuration.

Dependent PRs
ManageIQ/manageiq-appliance#282
ManageIQ/manageiq-api#828
ManageIQ/manageiq-appliance_console#117

To test:

Follow the ManageIQ OpenID-Connect documentation, found here, to configure an ManageIQ appliance for OpenID-Connect authentication and
confirm the API can be user with:

1. Basic auth using admin/
2. A JWT acquired from the OpenID-Connect Identity Provider then pass the JWT in the header to make a request to the ManageIQ API
3. An API Auth token

Examples of each of the above 3:

1. Basic auth using admin/

curl -L -vvv -k --user admin:smartvm -X GET -H "Accept: application/json" https://${OID_CLIENT_HOST}/api/users

2. A JWT acquired from the OpenID-Connect Identity Provider then pass the JWT in the header to make a request to the ManageIQ API

TOKEN_ENDPOINT="https://${KEYCLOAK_SERVER}:8443/auth/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token"

RES=`curl -k -L --user ${USER}:${PASSWORD} -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password" \
   -d "client_id=${KEYCLOAK_CLIENT_ID}" \
   -d "client_secret=${OID_CLIENT_SECRET}" \
  -d "username=$USER" \
  -d "password=$PASSWORD" \
  $TOKEN_ENDPOINT`

ACCESS_TOKEN=`echo $RES | jq -r '.access_token'`

curl -L -vvv -k -X GET -H "Authorization: Bearer ${ACCESS_TOKEN}" https://${OID_CLIENT_HOST}/api/users | jq

3. An API Auth token

TOKEN_ENDPOINT="https://${KEYCLOAK_SERVER}:8443/auth/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token"

RES=`curl -k -L --user ${USER}:${PASSWORD} -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=password" \
  -d "client_id=${KEYCLOAK_CLIENT_ID}" \
  -d "client_secret=${OID_CLIENT_SECRET}" \
  -d "username=$USER" \
  -d "password=$PASSWORD" \
  $TOKEN_ENDPOINT`
ACCESS_TOKEN=`echo $RES | jq -r '.access_token'`

RES=`curl -L -vvv -k -X GET -H "Authorization: Bearer ${ACCESS_TOKEN}" https://${OID_CLIENT_HOST}/api/auth`
API_AUTH_TOKEN=`echo $RES | jq -r '.auth_token'`

curl -L -vvv -k -X GET  -H "Accept: application/json" -H "X-Auth-Token: ${API_AUTH_TOKEN}" https://${OID_CLIENT_HOST}/api/users | jq

[jvlcek]

@miq-bot add_label wip
Setting wip label until more testing is done.

[miq-bot]

Checked commit jvlcek@a6feb2c with ruby 2.5.7, rubocop 0.69.0, haml-lint 0.28.0, and yamllint
1 file checked, 0 offenses detected
Everything looks fine. 🍰

[Fryguy]

cc @carbonin

[abellotti]

LGTM!!

Let Apache do the ✨

[jvlcek]

@bdunne FYI

[jvlcek]

@miq-bot remove_label wip

[simaishi]

Jansa backport details:

$ git log -1
commit d6b8005acc510ea1700ac35f055b8f5eaf1cbd4c
Author: Jason Frey <fryguy9@gmail.com>
Date:   Fri May 8 16:33:03 2020 -0400

    Merge pull request #20131 from jvlcek/oidc_to_httpd_config_issue_19866

    Move API OpenID-Connect support to Apache configuration

    (cherry picked from commit 70f97e6688eef3c48d498b12e3af4d06016f35aa)