Auth: Check id token expiry date

[akselleirv]

What is this feature?

Verify that the ID token has not expired.

Why do we need this feature?

When using the feature toggle accessTokenExpirationCheck it only checks for the expiry date of the access token and not the ID token. When using AzureAD to authenticate it issues an ID token which expires before the access token and it results in the user experiencing 401.

Who is this feature for?

For users which uses accessTokenExpirationCheck.

Which issue(s) does this PR fix?:

Fixes #65380

Special notes for your reviewer:

Please check that:

• It works as expected from a user's perspective.
• If this is a pre-GA feature, it is behind a feature toggle.
• The docs are updated, and if this is a notable improvement, it's added to our What's New doc.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Jguer]

@mgyongyosi can you take a look?

@akselleirv I think your implementation is missing in the second path pkg/services/authn/authnimpl/sync/oauth_token_sync.go

The context handler path will be removed soon.

[feature_toggles]
authnService = true

can be used to enable the new path (although it should now be the default in main)

[akselleirv]

Hello @Jguer and @mgyongyosi,

I've added the expiry check to the handler you mentioned.
Let me know if I should it remove it from the original handler path.

[mgyongyosi]

Hey @akselleirv,

Thank you for your contribution to Grafana! Currently I'm working on this part, so expect some changes from upstream, but those should be minor. I left some feedback to you, could you please change your implementation based on those suggestions?

[linoman]

👋 Hello @akselleirv and thank you for your contribution! As @Jguer and @mgyongyosi have suggested, you don't need to change anything at pkg/services/contexthandler/contexthandler.go since it will be removed soon. This is already blocked from being used by the feature flag that @Jguer mentioned.

Please revert it in order to approve and merge this PR.

Please review @mgyongyosi comments.

PS I left a small non-blocking code suggestion.

[akselleirv]

Thank you for the the detailed feedback @mgyongyosi! I've updated the PR with your suggested changes :)

[mgyongyosi]

Stellar work on this @akselleirv! ⭐ Thank you again, your PR has been merged!