OIDC: Implement activation using OAuth 2.0, openid scope

[romanstrobl]

OAuth 2.0 Parameters:

• implemented version of OAuth: 2.0
• implemented flows: authorization code
• OAuth 2.0 scope: openid, additional scopes may be present
• user ID claim: sub

Direct Activation Type Parameters

Following parameters are used during OIDC activation:

• method - oidc - to separate from other custom activations and enable default functionality in enrollment server
• clientId - OAuth 2.0 client identification
• code - OAuth 2.0 authorization code
• nonce - nonce used in the OAuth 2.0 flow

Direct Activation Request:

{
  "type": "DIRECT",
  "identityAttributes": {
      "method": "oidc",
      "clientId": "1234567890abcdef",
      "code": "1234567890abcdef",
      "nonce": "K1mP3rT9bQ8lV6zN7sW2xY4dJ5oU0fA1gH29o"
  },
  "customAttributes": {
  },
  "activationData": "..."
}

Default implementation:

• obtain OAuth 2.0 tokens (access, refresh, ID) based on authorization code
• validate tokens, see: https://openid.net/specs/openid-connect-core-1_0.html#TokenResponseValidation
• verify nonce value from ID token with value sent as parameter
• use client ID and client secret for authentication
• The sub value from ID token is the user ID for activation

[banterCZ]

@kopovan Most probably will be tested end-to-end with the mobile application.

[kopovan]

Waiting for PR https://github.com/orgs/wultra/projects/29/views/1?pane=issue&itemId=79549824

then @Hopsaheysa will build testing app

[kopovan]

iOS done: https://github.com/wultra/mtoken-ios/pull/1069#issuecomment-2378837685 waiting for Android build