Epic: SSO/OIDC Setup Flow (for Dedicated)

[AlexTugarev]

Summary

The goal of this epic is to enable setting up of OIDC identity providers, which would make Dedicated installation accessible.

Context

This is part and a refinement of #7761.

Scope

This epic has a limited scope to provide a starting point for Dedicated installations. Most parts of it are meant to be revised afterwards, e.g. the injected admin account should be replaced by a proper service account.

Task Breakdown

• Extension to the dashboard
  SSO/OIDC clients to be added/configured on Org-level (aka Teams) with owner permissions.
  • Enablement to be controlled by a feature flag.
  • • [public-api] implement CreateOIDCProviderConfig #15150
  • • [SSO] associate OIDC client configurations with ~team~ org #15708
  • • [public-api] implement ListOIDCProviderConfigs #15153
  • • [sso/oidc] Add OIDC Clients UI #14278
• Setup Mode
  • • Setup user for Dedicated preview envs #15657
  • • [werft] add with-dedicated-emulation switch #15587
  • Login into the setup account via URL with token (or simple form.)
  • Setup user should be able to navigate the pages of the dashboard.
• Creation of new Org (aka Team) and OIDC client during setup using the dashboard.
  • New form to create OIDC client configuration.
  • Listing of configured OIDC clients.
• Login through the OIDC connection:
  • First: following a handcrafted URL
    • Integration into the login form can be done as follow-up.