Evaluate use of oauth2.0 device authorization grant for openstack client authentication

[fkr]

Hypothesis: that device authorization grant is the way to go in order to properly federate auth of an openstack client

As a SCS Developer, I want to evaluate and benchmark this hypothesis.
This includes:

• Implement something in openstack/keystoneauth code
• Test it against keycloak/keystone in the testbed

Definition of Done:

• We know wether device authorization grant will solve our problem
• There exists a sketch on how to properly implement the targeted solution
• All acceptance criteria are met
• Documentation has been updated

[reqa]

https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow#how-it-works

[reqa]

Zitadel currently doesn't yet support it, but that shouldn't block us, as 1. Keycloak apparently already does, so we have a target to test against and 2. Zitadel is open for doing this at some point: zitadel/oidc#141

[fforootd]

Zitadel currently doesn't yet support it, but that shouldn't block us, as 1. Keycloak apparently already does, so we have a target to test against and 2. Zitadel is open for doing this at some point: zitadel/oidc#141

👍 Just let us know if this important to your project. We would be happy to assist.

[reqa]

I've implemented support for the "OAuth 2.0 Device Authorization Grant" flow here. Next steps would be:

• Try to upstream the patch (simply create a Pull request or be more proactive?)
• Check in Testbed if Keycloak Identity Brokering to a remote IdP (or rather OIDC OP) actually works with this

Side note: Apparently with this flow Keycloak does not (yet?) support the Keycloak specific mechanism of explicit selection of a remote IdP via ?kc_idp_hint URL parameter, see https://keycloak.discourse.group/t/kc-idp-hint-and-oauth-2-0-device-authorization-grant/16848 .

[mffap]

Zitadel currently doesn't yet support it, but that shouldn't block us, as 1. Keycloak apparently already does, so we have a target to test against and 2. Zitadel is open for doing this at some point: zitadel/oidc#141

Looks like the device authorization grant has been merged into our oidc library. So probably will land very soon in zitadel.