Apply Microsoft Azure OIDC Authentication flow

[vinokurig]

What does this PR do?

Apply Microsoft Azure OIDC Authentication flow

DO NOT MERGE until eclipse-che/che-operator#2097 is merged

Screenshot/screencast of this PR

What issues does this PR fix or reference?

fixes eclipse-che/che#23505

How to test this PR?

1. Apply the che-server pull request image: quay.io/eclipse/che-server:pr-968
2. Configure a Microsoft Entra ID Application
3. Apply the Azure DevOps oauth secret:

kind: Secret
apiVersion: v1
metadata:
  name: azure-devops-oauth-config
  namespace: eclipse-che
  labels:
    app.kubernetes.io/component: oauth-scm-configuration
    app.kubernetes.io/part-of: che.eclipse.org
  annotations:
    che.eclipse.org/oauth-scm-server: azure-devops
stringData:
  id: <Application (client) ID>
  secret: <client secret>
  tenant-id: <tenant id>
type: Opaque

4. Start a workspace from the Azure DevOps repository HTTPS url, consent the oauth request.

See: workspace starts, project is cloned. Token is added to the user namespace.

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Release Notes

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-server:pr-968

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-968", name: che}]}}]"

[vinokurig]

/retest

[tolusha]

Magic number, do we have the source of them?

[vinokurig]

Entra ID v2.0 requires Azure DevOps App ID URI in the scope, which is 499b84ac-1321-427f-aa17-267ca6975798 see https://learn.microsoft.com/en-us/answers/questions/5807316/invalid-scope-error-on-oidc-token-request

[tolusha]

Could you pls add that link to che.properties?

[vinokurig]

done

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-server:pr-968

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/cheServer/deployment", "value": {containers: [{image: "quay.io/eclipse/che-server:pr-968", name: che}]}}]"

[tolusha]

Tested

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha, vinokurig

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment