SSO for Local Development of Nautobot

[whitej6]

What's Changed

• Added the ability to ship a prebuilt keycloak container for local sso development
• Provides ability to smoke test social auth core integration
• Precursor to multiple sso

TODO

• Explanation of Change(s)
• Documentation Updates (when adding/changing features)
• Outline Remaining Work, Constraints from Design

[glennmatthews]

I love where this is going! Probably would be good to have some documentation for using this setup in the developer docs?

[gsnider2195]

Would we gain anything by running the container in dev mode?

[gsnider2195]

Is it normal for the SSO credential to get cached? Ex

• Login to Nautobot with SSO
• Logout of Nautobot
• Click login again, click login with SSO
• Automatically logged in with the same SSO user that you logged in with before

[whitej6]

The caching of creds is actually a cached session with keycloak not cached with nautobot. The timeout/auth settings can be updated from keycloak if you would like to chance this behavior.

[whitej6]

@gsnider2195 dev mode may give more logging but I am not familiar enough to say for sure. Please review the updated docs I just added.

[whitej6]

@glennmatthews @gsnider2195 @bryanculver Outside of adding the documentation, I have resolved all outstanding items. If we are good with how it's implemented I will start the SSO dev docs. If you could 👍 this comment to let me know it would be appreciated.

[gsnider2195]

If you forget to run invoke provision-sso and try to bring up the keycloak container docker ends up creating a development/nautobot-realms.json/ directory which breaks subsequent calls to invoke provision-sso. Can we use a small bash or python script to generate that json file when the container starts up instead of using a separate invoke command? I think this would be a better developer experience

[gsnider2195]

Still waiting to convert the invoke provision_sso logic into something that happens in the keycloak container at runtime.

[bryanculver]

Please also address merge conflicts.

[bryanculver]

@nautobot/core having this in place will help for #3142