Set up Keycloak and integrate with API

[karlhorky]

Merging blocked on #575 and #627 because this contains commits from those PRs.

To use, (re)build containers:

docker-compose down
rm build/{api,keycloak,keycloak-db,local-api-data-watcher-pusher}
make build/api
make build/keycloak
make build/keycloak-db
make build/local-api-data-watcher-pusher

TODO:

• Fork keycloak-admin-client to https://github.com/amazeeio/keycloak-admin-client
• Fix security warnings
• Merge create group upstream into fork. Done: amazeeio/keycloak-admin-client#1
• Add keycloak-admin-client dependency to API
• Switch to keycloak-admin instead of using our fork
• Wait on Keycloak startup (~20 seconds) before accepting API requests
• addProject mutation creates Keycloak group
• updateProject with a new name renames Keycloak group
• updateProject with a new customer deletes Keycloak users with customer-only project access from the Keycloak group
• updateProject with a new customer adds Keycloak users with customer-only project access to the Keycloak group
• deleteProject deletes Keycloak group
• deleteAllProjects deletes all corresponding Keycloak groups
• addUser mutation creates Keycloak user
• addUserToProject adds a Keycloak user to a group
• removeUserFromProject deletes a Keycloak user from a group
• removeAllUsersFromAllProjects deletes all Keycloak users from all groups
• addUserToCustomer adds a Keycloak user to the groups corresponding to the customer's projects
• removeUserFromCustomer deletes a Keycloak user from the groups corresponding to the customer's projects
• removeAllUsersFromAllCustomers deletes all Keycloak users from the groups corresponding to all customers' projects
• Update of users
• Delete of users
• Move truncation code to each DAO file and add Keycloak deletion commands
• Make user.email column unique
• Require email to be passed to user creation command
• Adapt addUser mutations in api-data.gql to also specify email
• Configure the environment variables
• Pull request to override config after auth Ability to set realmName (and maybe other settings) after first authentication keycloak/keycloak-nodejs-admin-client#3
• Resolve any issues with short 60s token timeout (maybe this isn't a problem? or if it is, we can use the refresh_token)
• Fix bug with user email updating causing loss of group membership
• If User has been created from GitLab Sync system, add provided Gitlab UserID and Username as Identity Provider Links in Keycloak for the gitlab identity provider
• Fix Flow types in all API -> DAO files
• Migrate to better folder structure for resolvers, SQL files, Keycloak files

Maybe:

• Fix broken tests in keycloak-admin-client, open PR Using the keycloak-admin module instead
• Change the config path back to the default $HOME/.keycloak/kcadm.config (see 3080d6c)
• Improve token refresh (currently setInterval) to use refresh token to get new token
• Move API authentication to Keycloak
• Move rest of Users implementation to Keycloak

Nope:

• deleteCustomer deletes all Keycloak groups corresponding to customer projects Don't need to do this because deleteCustomer only deletes customers without any projects assigned to them

Closes #620

---

Get a 60 second admin token

$ curl -X POST \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'username=admin&password=admin&client_id=admin-cli&grant_type=password' \
    http://localhost:8088/auth/realms/master/protocol/openid-connect/token
{"access_token":"<access token>","expires_in":60,"refresh_expires_in":1800,"refresh_token":"<refresh token>","token_type":"bearer","not-before-policy":0,"session_state":"c22cd523-4467-4068-8524-88f7a23261c9","scope":"profile email"}

GET users

$ curl -v -X GET \
    -H 'Authorization: Bearer <access token>' http://localhost:8088/auth/admin/realms/lagoon/users
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8088 (#0)
> GET /auth/admin/realms/lagoon/users HTTP/1.1
> Host: localhost:8088
> User-Agent: curl/7.54.0
> Accept: */*
> Authorization: Bearer <access token>
>
< HTTP/1.1 200 OK
< Connection: keep-alive
< Cache-Control: no-cache
< Content-Type: application/json
< Content-Length: 326
< Date: Wed, 19 Sep 2018 15:01:53 GMT
<
* Connection #0 to host localhost left intact
[{"id":"2c6cf0a8-c07d-42af-bce6-ec4ebdd4aa59","createdTimestamp":1537365502713,"username":"user","enabled":true,"totp":false,"emailVerified":false,"disableableCredentialTypes":["password"],"requiredActions":[],"notBefore":0,"access":{"manageGroupMembership":true,"view":true,"mapRoles":true,"impersonate":true,"manage":true}}]%

Ref: https://stackoverflow.com/questions/48507224/cant-access-keycloak-rest-api-methods-404

[karlhorky]

Merged into #675 to collaborate better with rest of team. Will continue from there.