Add custom parameters to authorize and logout endpoints

[eva-mueller-coremedia]

This PR

• provides a different approach to solve Logout issue: Required String parameter 'redirect_uri' is not present #229 resp. New config option: Enable AWS Cognito Logout #241
• solves Allow query params for ID provider URLs #443

Additionally, some housekeeping (fixing typos, simplify statements) has been done.

The main change has been done in eb0d2ba:

• Add new input fields for login resp. logout query parameters in the Jenkins management backend
• maybeOpenIdLogoutEndpoint has been refactored when it comes to combining all parameters
• Login query parameters are not allowed to overwrite keys as defined in org.pac4j.oidc.config.OidcConfiguration
• Logout query parameters are not allowed to overwrite keys as set in maybeOpenIdLogoutEndpoint like id_token_hint, state, post_logout_redirect_uri

Testing done

This change has been tested by unit tests as well as local testing agains AWS Cognito.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[codecov]

Codecov Report

Attention: Patch coverage is 87.20930% with 11 lines in your changes missing coverage. Please review.

Project coverage is 73.70%. Comparing base (84359ac) to head (a2de73e).
Report is 8 commits behind head on master.

Files with missing lines	Patch %	Lines
...va/org/jenkinsci/plugins/oic/OicSecurityRealm.java	88.33%	5 Missing and 2 partials ⚠️
...ci/plugins/oic/OicQueryParameterConfiguration.java	80.95%	1 Missing and 3 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #480      +/-   ##
============================================
+ Coverage     71.73%   73.70%   +1.97%     
- Complexity      222      252      +30     
============================================
  Files            17       18       +1     
  Lines          1033     1084      +51     
  Branches        148      155       +7     
============================================
+ Hits            741      799      +58     
+ Misses          201      195       -6     
+ Partials         91       90       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jtnord]

Hi @eva-mueller-coremedia thanks for this.

I have had a quick look and have a few comments around the UX side.

The extra parameters would IIUC not be needed in the majority of conformant IDPs, as such do you thing they should be hidden behind an advanced section?

the use of a single string for multiple keyvalue pairs (and the encoding /splitting shenaningans) would seem to be error prone (and it lacks good warnings on invalid input). (a value may need to encode & and then you need to escape it)
Would making the KeyValue a Describable and using a repeatable option using repeatableProperty or the like (which can then perform individual valuation of the key and the value). NB not sur how this would look in CasC.

[eva-mueller-coremedia]

@jtnord Thanks for the feedback, will try to follow a key value pair pattern.

If you don't mind, I would like to remove the UI at all - only provide it to be set via CasC resp. Java/Groovy code. Any objections?

[jtnord]

@jtnord Thanks for the feedback, will try to follow a key value pair pattern.

If you don't mind, I would like to remove the UI at all - only provide it to be set via CasC resp. Java/Groovy code. Any objections?

it's generally considered bad to have something exposed in the UI and not CasC and vice versa. Not exposing in the UI can lead to it getting overridden if someone saves the Jenkins form in the UI (which I say you should never do as if you manage by code you should have a read only system UI, but it is useful on test systems where you want to make changes in the UI and then export the config for applying to a different server).

[eva-mueller-coremedia]

@jtnord Thanks for the feedback, will try to follow a key value pair pattern.
If you don't mind, I would like to remove the UI at all - only provide it to be set via CasC resp. Java/Groovy code. Any objections?

it's generally considered bad to have something exposed in the UI and not CasC and vice versa. Not exposing in the UI can lead to it getting overridden if someone saves the Jenkins form in the UI (which I say you should never do as if you manage by code you should have a read only system UI, but it is useful on test systems where you want to make changes in the UI and then export the config for applying to a different server).

Understood. 👍 I will have a look to implement it the way you described initially. Thanks for the explanation!