SSO Refactor for Global IdP values

Package Merge Request

Package Changes

Summary

When upgrading, the following changes may affect SSO:

• Values related to the Identity Provider paths, certificates, and OIDC claims were deprecated and replaced with a set of global values. Deprecated values will still work, but you will see a deprecation notice in the Helm upgrade notes. See the values.yaml for details on new values.
• (ArgoCD, GitLab, Grafana, Sonarqube): Login button label (name) is global and defaults to SSO.
• (Authservice): When jwksUri and jwks are both defined, jwksUri takes precedence (previously, jwks took precedence).
• (Authservice, Logging): Defaults expanded for URL endpoints and claim names to support global values and non-keycloak identity providers.

Details

ArgoCD

• default OIDC name changed from blank to SSO. This changes the login button label.

Authservice

• Preferences jwksUri over jwks if both are defined. Previously jwks was preferred. This allows jwks to be dynamically updated if both are defined.
• issuer_uri, authorization_uri, token_uri, logout_redirect_uri will be populated globally and per chain when the new values are used. This eliminates the need to populate oidc.host and oidc.realm and provides support for non-keycloak identity providers.

GitLab

• default label changed from blank to SSO. This changes the login button label.
• client_options: identifier and secret no longer default to global sso values. Those values are reserved for authservice use and should not have been used as defaults.

Grafana

• default name changed from blank (which resulted in an "OAuth" label) to SSO. This changes the login button label.

Logging

• issuer, auth_url, token_url, userinfo_url, endsession_url and jwkset_url will be populated when new values are used. This eliminates the need to populate oidc.host and oidc.realm and provides support for non-keycloak identity providers.
• Default claim names for principal, groups, and mail are populated with typical values from Keycloak and can be overridden in global variables.

Sonarqube

• default providerName changed from blank to SSO.

Twistlock

• default provider_name changed from blank to SSO.

Package MR

No package changes

For Issue

Closes #1361 (closed)

docs/guides/using-bigbang/2.0-migration.md

+# Migration to Big Bang 2.0
+
+## Values
+
+### General
+
+| Old | New | Notes |
+|--|--|--|
+| addons.\*.enabled | packages.\*.enabled | |
+
+### SSO Values
+
+| Old | New | Notes |
+|--|--|--|
+| sso.oidc.host | sso.host | Applies to both oidc and saml |
+| sso.oidc.realm | sso.realm | Applies to both oidc and saml |
+| sso.jwks | [Deprecated] | Use sso.oidc.jwksUri instead |
+| sso.jwks_uri | sso.oidc.jwksUri ||
+| sso.client_id | packages.authservice.sso.client_id | Only authservice uses this |
+| sso.client_secret | packages.authservice.sso.client_secret | only authservice uses this |
+| sso.token_url | sso.url + sso.oidc.token | endpoint is now relative to base url |
+| sso.auth_url | sso.url + sso.oidc.authorization | endpoint is now relative to base url |
+| sso.certificate_authority | sso.certificateAuthority.cert ||
+| sso.secretName | sso.certificateAuthority.secretName ||
+| addons.\*.sso.enabled | packages.\*.sso.enabled | |
+| addons.\*.sso.client_id | packages.\*.sso.client_id | Only used if defaults places the value in the correct location |
+| addons.sonarqube.sso.provider_name | sso.name | IdP values are global |
+| addons.sonarqube.sso.certificate | TBD | Jwks certificate from IdP |
+| addons.sonarqube.sso.login | sso.claims.user | IdP fields are global |
+| addons.sonarqube.sso.name | sso.claims.name | IdP fields are global |
+| addons.sonarqube.sso.email | sso.claims.email | IdP fields are global |
+| addons.sonarqube.sso.group | TBD ||
+
+### Database Values
+
+| Old | New | Notes |
+|--|--|--|
+| addons.\*.database.\* | packages.\*.database.\* | |
+
+### Object Values
+
+| Old | New | Notes |
+|--|--|--|
+