Improve OIDCIssuer abstraction

[nsmith5]

Description

To add an new class of oidc issuer (eg. spiffe, github workflow...) to fulcio requires touching a lot of different areas of the code base. Here are all the locations I can think of

• In this switch you need to check the issuer type and call the right challenge
• You need to add a new issuer type to the config package
• You need to add a new challenge in the challenges package
• You need to map your challenge response into x509 fields (URI vs. Email vs customer extensions)

I feel like these OIDC issuer types would be easier to test and probably easier to write if we make a interface for them all to obey and make the implementation details of each one abstracted from the rest of the code base.

Not sure what that interface would be. Has anyone gave this idea some thought already? It seems like at a high level, the issuers need to

• Match against the issuer from a token (i.e to check "is this the right issuer for this token?")
• Map its claims into x509 details
• Validate a token? (Not 100% on this one as it kinda of seems like we use the same OIDC machinery to do this for all providers really..)

[mattmoor]

I definitely agree this is overdue for a refactor. This is leftover from when there were 2-3 options, and just keeps growing.

I'd be happy to give feedback / discuss if you have ideas!

[nsmith5]

Sweet, I'll give it a little thought and share a WIP PR or something if I brew up an idea.

[nsmith5]

Drafted a proposal for this change here https://docs.google.com/document/d/1PKAou7wEmEob4VOLq6rFlx5maOM5hkJ3XffZizfwdFw/edit?usp=sharing. Looking for some eyeballs before diving in to implementing

[haydentherapper]

@nsmith5 Do you have an estimate as to the amount of work left for this refactor? Context is determining when to make a new release of Fulcio.

[nsmith5]

Yup remaining work is as follows:

• Make FulcioConfig obey the Issuer interface
• Stick that in an IssuerPool and replace the current FulcioConfig usage
• Break up all the issuer implementations in FulcioConfig and ChallengeResults one by one

So maybe a week or two?

[haydentherapper]

Thanks. We'll likely cut the prerelease candidate from before this then, cherry-picking in any bug fixes.

[haydentherapper]

Closing as this has been wrapped up