ELNBuildSync: Add OpenID Connect support

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED

roles/openshift-apps/elnbuildsync/templates/elnbuildsync_static.yml.j2

@@ -14,5 +14,18 @@ configuration:
     name: "{{ ebs_db_name }}"
     driver: postgresql+asyncpg
     user: "{{ ebs_db_user }}"
-  open_id_connect: false
+  open_id_connect:
+    auth_url: "https://id{{env_suffix}}.fedoraproject.org/openidc/Authorization"
+    client_id: "{{ ebs_oidc_client_id }}"
+    client_secret: "{{ ebs_oidc_client_secret }}"
+    token_endpoint: "https://id{{env_suffix}}.fedoraproject.org/openidc/Token"
+    userinfo_endpoint: "https://id{{env_suffix}}.fedoraproject.org/openidc/UserInfo"
+    # OAuth2 scopes to request (groups scope required for authorization)
+    scopes:
+      - openid
+      - profile
+      - https://id.fedoraproject.org/scope/groups
+    # Users must be a member of at least one of these groups to access /trigger
+    admin_groups:
+      - eln
   email: false

roles/openshift-apps/elnbuildsync/vars/main.yml

@@ -26,3 +26,5 @@ ebs_build_target: eln
 ebs_stable_tag: eln
 
 ebs_db_host: db01{{env_suffix}}.{{datacenter}}.fedoraproject.org
+
+ebs_fedora_oidc_client_id: "{{ ebs_oidc_client_id }}"

roles/openshift-apps/elnbuildsync/vars/production.yml

@@ -10,3 +10,5 @@ ebs_db_user: elnbuildsync
 ebs_db_name: elnbuildsync
 
 ebs_koji_profile: koji
+
+ebs_fedora_oidc_client_secret: "{{ ebs_oidc_client_secret }}"

roles/openshift-apps/elnbuildsync/vars/staging.yml

@@ -10,3 +10,5 @@ ebs_db_user: elnbuildsync
 ebs_db_name: elnbuildsync
 
 ebs_koji_profile: stg
+
+ebs_fedora_oidc_client_secret: "{{ ebs_oidc_client_secret_stg }}"