Allow fixing the redirect_url when authenticating requests with different hostnames

[Thanhphan1147]

Currently, the behavior of the oidc authenticator is that:

1. If a request with hostname example.com is sent to the agent, it will use the hostname to fetch the OIDC client from the statically defined config or register a new one under that hostname if arg_{client_id, client_secret, redirect_url}.
2. Then the redirect URL is built, in this case it will be example.com/oauth2/callback.
3. On the OIDC response the agent will issue a redirect to example.com to set the cookie on the client brower.
4. The redirect URL will change with different hostname, and the agent assumes that the hostname of the original destination is the hostname in the callback URL.

While this is fine for single hostname, when haproxy is serving incoming request with a lot of different hostnames the list of allowed redirect URLs that needs to be configured will need to be updated constantly on the IDP side which is not ideal. Some IDPs also only allow one set of credential per redirect URL.

This PR tries to provide a solution for cases like that where the redirect URL can be set to a fixed value regardless of the hostname of the incoming request. The client's original destination is now embeded into the state and used in the final redirect to set the client cookie. The flow now will be something like this:

--> client requests example.com 
--> redirect to ( <idp URL>?redirect_url=auth.example.com/oauth2/callback&state=...(contains original destination) ) 
--> auth.example.com/oauth2/callback 
--> redirect to example.com with set-cookie

[Thanhphan1147]

Hi @mougams, can you take a look at this PR when you have the time? I'm happy to discuss about it or provide more context if needed!

[mougams]

Hi @mougams, can you take a look at this PR when you have the time? I'm happy to discuss about it or provide more context if needed!

Hi @Thanhphan1147 - thank you for your patch. Could you please also update the test, mostly in tests/oidc_authentication_test.go. Thx!

[Thanhphan1147]

After thinking about it a bit, there are quite a few security implications with this PR, mainly about storing the original URL in the state as well as third-party cookies. I'm closing the PR for now, thanks!