Enable Auth flow for User Account Creation

[lukehinds]

Currently new users are created with the medic auth command. The assumption here, is that a root admin will create the account on the users behalf (or the user and the root user are the same person).

When we release our Baby SaSS / MVP, this will not work for folks external to stacklok.

We need away for them to easily create an account using sso / OAuth flows (login with Google/Github/Microsoft etc).

The flow will be to run medic, generate an auth_url and open that within a browser. Similar to the flow we use for enroll.

When we do this, we need to keep in mind that this feature will also be needed by the UI now that we have @davolokh onboard who will be looking to build out our frontend. With the frontend instead of a JWT being saved within a local file to the CLI, it will instead need to be a session cookie used by the browser.

[lukehinds]

@eryn-muetzel 👀

[lukehinds]

I should add, we could also have email signup (user creates their own account without an iDP acting for them).

[eryn-muetzel]

Thanks - this looks good. I'll add it as a user story to the epic once I have that in GitHub

[lukehinds]

Did this get mapped @eryn-muetzel ? I am thinking this could be a good issue for @eleftherias who has exp with Oauth2 / social logins

Cc @jhrozek @JAORMX

[jhrozek]

Did this get mapped @eryn-muetzel ? I am thinking this could be a good issue for @eleftherias who has exp with Oauth2 / social logins

Cc @jhrozek @JAORMX

This should probably become an epic of its own with a design doc which we should help with rather than throwing @eleftherias into the deep end :-)

Dumping what we discussed on a call with @JAORMX and @rdimitrov a little while ago:

• how do we represent the users who auth against an external IDP in our DB so that we can bind mediator specific RBAC to them
• we should think about multitenancy (e.g. I auth with my GH account but I'm a member of "stacklok" and "Kubernetes" groups/projects with different privileges)
• this might require rework on how we handle authnz, currently we just have a a hardcoded map

[eleftherias]

Turning this from an epic into an issue and adding it as a sub-task of Social Logins