feat: identity group auth

Description

Identity Plugin Pepr component for managing group authorization to applications. This is only the implementation, meaning a package (i.e. grafana) will need to be configured for this to work. This is also dependent on a new release of uds-identity-config.

How to test

Update the identity config image here and here to include/change : ttl.sh/uds-core-config:group-plugin-groups-attribute

In addition to the identity config image, update the grafana package to require a specific group to access the application like so:

apiVersion: uds.dev/v1alpha1
kind: Package
metadata:
  name: grafana
  namespace: {{ .Release.Namespace }}
spec:
  sso:
    - name: Grafana Dashboard
      clientId: uds-core-admin-grafana
      redirectUris:
        - "https://grafana.admin.{{ .Values.domain }}/login/generic_oauth"
      groups:
        anyOf:
          - /UDS Core/Admin

With those changes utilize the test-uds-core task to test, no user is created by default so either go into keycloak and setup the user manually or go to sso.uds.dev and register a user there, then navigate to the grafana.admin.uds.dev and you should be redirected to a login page and depending on if you're in the admin group or not be granted access to the grafana dashboard.

Related Issue

Relates to uds-identity-config PR

Type of change

[ ] Bug fix (non-breaking change which fixes an issue)
[x] New feature (non-breaking change which adds functionality)
[ ] Other (security config, docs update, etc)

Checklist before merging

[x] Test, docs, adr added or updated as needed
[x] Contributor Guide Steps(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request) followed

defenseunicorns / uds-core