Keycloak SPI for Builtin Users Authentication

[GPortas]

What this PR does / why we need it:

The only modifications I made to Dataverse include:

• Adding an endpoint to validate credentials (email/username and password).
• Making a slight adjustment to the logic of lookupUserByOIDCBearerToken to first check whether the username from the bearer token belongs to a built-in user in AuthenticatedUser before querying AuthenticatedUserLookup.

This PoC can serve as a foundation for a more refined implementation. However, there are still aspects to explore, such as handling potential account duplication (when a user has both built-in and external IDP accounts) and further improving the SPI implementation.

The SPI has been implemented following the docs https://www.keycloak.org/docs/latest/server_development/index.html#_user-storage-spi

Before running the environment, you need to build the SPI .jar file. Use mvn -Pextension clean install -DskipTests=true located inside the conf/keycloak/builtin-users-spi folder.

If you want to run this branch on your localhost, once the containers are up and running, you need to register the SPI in Keycloak. In a future iteration, it would be interesting to move this configuration to the realm config JSON file so that it auto-configures on startup.

You can do this as shown below:

kccconf.mov

You can run the SPI in the dataverse-frontend (branch: https://github.com/IQSS/dataverse-frontend/tree/poc/oidc-builtin-users) by running the environment pointing to this branch with ./run-env.sh 11157-builtin-users-oidc-auth

Remember to add the SPI provider through the Keycloak admin console ( http://localhost:8000/admin/ kcadmin/kcpassword)

builtinusersspa.mov

Which issue(s) this PR closes:

• Closes #

Special notes for your reviewer:

Suggestions on how to test this:

Does this PR introduce a user interface change? If mockups are available, please link/include them here:

Is there a release notes update needed for this change?:

Additional documentation:

https://www.keycloak.org/docs/latest/server_development/index.html#_user-storage-spi

[coveralls]

coverage: 22.704%. first build
when pulling 267c6e7 on 11157-builtin-users-oidc-auth
into 106fb6f on develop.

[github-actions]

📦 Pushed preview images as

ghcr.io/gdcc/dataverse:11157-builtin-users-oidc-auth

ghcr.io/gdcc/configbaker:11157-builtin-users-oidc-auth

🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name.