Minimalistic support for group filtering in oidc connector

[mdpradeep]

Overview

Filter users based on groups in OIDC connector.

What this PR does / why we need it

Currently it is not possible to filter users based on groups like it is done with the google connector. This PR is an attempt to support group filtering in the oidc connector. The connector configuration takes an additional configuration as below to specify what the allowed groups are. If the user's groups belong to at least one of the allowedGroups, then authentication will be successful. The other change is to indicate that the user does not belong to allowed groups if authentication fails because the user does not belong to any of the allowed groups.

{
            "name": "My-oidc",
            "config": {
                "issuer": "<ISSUER>",
                "clientID": "12345678",
                "redirectURI": "<Dex Callback>",
                "clientSecret": "12345678",
                "insecureSkipEmailVerified": true,
                "insecureEnableGroups": true,
                "getUserInfo": true,
                "allowedGroups": ["XYZ", "ABC"],
                "scopes": ....
            },
            "id": "myoidc",
            "type": "oidc"
        }

Special notes for your reviewer

Does this PR introduce a user-facing change?

NONE

[nabokihms]

Debug messages don't seem like a necessary addition. The better approach is, for example, to trace HTTP requests to providers and check returned bodies. Custom debug messages are blocking this PR.

[nabokihms]

@mdpradeep, everything seems fine now according to the code and ready to be merged (when tests are successfully passed).

I'd like to take this feature to the upcoming v2.38.0 release, so waiting 🙂

[nabokihms]

Looks really nice. Thank you, @mdpradeep, for your contribution!