Create username scope, required for clients to get username in ID token

- For backwards compatibility with older Pinniped CLIs, the pinniped-cli
  client does not need to request the username or groups scopes for them
  to be granted. For dynamic clients, the usual OAuth2 rules apply:
  the client must be allowed to request the scopes according to its
  configuration, and the client must actually request the scopes in the
  authorization request.
- If the username scope was not granted, then there will be no username
  in the ID token, and the cluster-scoped token exchange will fail since
  there would be no username in the resulting cluster-scoped ID token.
- The OIDC well-known discovery endpoint lists the username and groups
  scopes in the scopes_supported list, and lists the username and groups
  claims in the claims_supported list.
- Add username and groups scopes to the default list of scopes
  put into kubeconfig files by "pinniped get kubeconfig" CLI command,
  and the default list of scopes used by "pinniped login oidc" when
  no list of scopes is specified in the kubeconfig file
- The warning header about group memberships changing during upstream
  refresh will only be sent to the pinniped-cli client, since it is
  only intended for kubectl and it could leak the username to the
  client (which may not have the username scope granted) through the
  warning message text.
- Add the user's username to the session storage as a new field, so that
  during upstream refresh we can compare the original username from the
  initial authorization to the refreshed username, even in the case when
  the username scope was not granted (and therefore the username is not
  stored in the ID token claims of the session storage)
- Bump the Supervisor session storage format version from 2 to 3
  due to the username field being added to the session struct
- Extract commonly used string constants related to OIDC flows to api
  package.
- Change some import names to make them consistent:
  - Always import github.com/coreos/go-oidc/v3/oidc as "coreosoidc"
  - Always import go.pinniped.dev/generated/latest/apis/supervisor/oidc
    as "oidcapi"
  - Always import go.pinniped.dev/internal/oidc as "oidc"

internal/controller/authenticator/jwtcachefiller/jwtcachefiller.go

@@ -21,6 +21,7 @@ import (
 	"k8s.io/klog/v2"
 
 	auth1alpha1 "go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1"
+	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	authinformers "go.pinniped.dev/generated/latest/client/concierge/informers/externalversions/authentication/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
 	pinnipedauthenticator "go.pinniped.dev/internal/controller/authenticator"
@@ -32,8 +33,8 @@ import (
 // These default values come from the way that the Supervisor issues and signs tokens. We make these
 // the defaults for a JWTAuthenticator so that they can easily integrate with the Supervisor.
 const (
-	defaultUsernameClaim = "username"
-	defaultGroupsClaim   = "groups"
+	defaultUsernameClaim = oidcapi.IDTokenClaimUsername
+	defaultGroupsClaim   = oidcapi.IDTokenClaimGroups
 )
 
 // defaultSupportedSigningAlgos returns the default signing algos that this JWTAuthenticator

internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go

@@ -15,6 +15,7 @@ import (
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
 	"go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1"
+	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	pinnipedclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	configInformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/config/v1alpha1"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
@@ -27,7 +28,7 @@ import (
 
 const (
 	secretTypeToObserve       = "storage.pinniped.dev/oidc-client-secret" //nolint:gosec // this is not a credential
-	oidcClientPrefixToObserve = "client.oauth.pinniped.dev-"              //nolint:gosec // this is not a credential
+	oidcClientPrefixToObserve = oidcapi.ClientIDRequiredOIDCClientPrefix
 )
 
 type oidcClientWatcherController struct {

internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher.go

@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/coreos/go-oidc/v3/oidc"
+	coreosoidc "github.com/coreos/go-oidc/v3/oidc"
 	"github.com/go-logr/logr"
 	"golang.org/x/oauth2"
 	corev1 "k8s.io/api/core/v1"
@@ -26,6 +26,7 @@ import (
 	corev1informers "k8s.io/client-go/informers/core/v1"
 
 	"go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1"
+	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	pinnipedclientset "go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned"
 	idpinformers "go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions/idp/v1alpha1"
 	"go.pinniped.dev/internal/constable"
@@ -97,11 +98,11 @@ type UpstreamOIDCIdentityProviderICache interface {
 type lruValidatorCache struct{ cache *cache.Expiring }
 
 type lruValidatorCacheEntry struct {
-	provider *oidc.Provider
+	provider *coreosoidc.Provider
 	client   *http.Client
 }
 
-func (c *lruValidatorCache) getProvider(spec *v1alpha1.OIDCIdentityProviderSpec) (*oidc.Provider, *http.Client) {
+func (c *lruValidatorCache) getProvider(spec *v1alpha1.OIDCIdentityProviderSpec) (*coreosoidc.Provider, *http.Client) {
 	if result, ok := c.cache.Get(c.cacheKey(spec)); ok {
 		entry := result.(*lruValidatorCacheEntry)
 		return entry.provider, entry.client
@@ -109,7 +110,7 @@ func (c *lruValidatorCache) getProvider(spec *v1alpha1.OIDCIdentityProviderSpec)
 	return nil, nil
 }
 
-func (c *lruValidatorCache) putProvider(spec *v1alpha1.OIDCIdentityProviderSpec, provider *oidc.Provider, client *http.Client) {
+func (c *lruValidatorCache) putProvider(spec *v1alpha1.OIDCIdentityProviderSpec, provider *coreosoidc.Provider, client *http.Client) {
 	c.cache.Set(c.cacheKey(spec), &lruValidatorCacheEntry{provider: provider, client: client}, oidcValidatorCacheTTL)
 }
 
@@ -129,8 +130,8 @@ type oidcWatcherController struct {
 	oidcIdentityProviderInformer idpinformers.OIDCIdentityProviderInformer
 	secretInformer               corev1informers.SecretInformer
 	validatorCache               interface {
-		getProvider(*v1alpha1.OIDCIdentityProviderSpec) (*oidc.Provider, *http.Client)
-		putProvider(*v1alpha1.OIDCIdentityProviderSpec, *oidc.Provider, *http.Client)
+		getProvider(*v1alpha1.OIDCIdentityProviderSpec) (*coreosoidc.Provider, *http.Client)
+		putProvider(*v1alpha1.OIDCIdentityProviderSpec, *coreosoidc.Provider, *http.Client)
 	}
 }
 
@@ -329,7 +330,7 @@ func (c *oidcWatcherController) validateIssuer(ctx context.Context, upstream *v1
 			return issuerURLCondition
 		}
 
-		discoveredProvider, err = oidc.NewProvider(oidc.ClientContext(ctx, httpClient), upstream.Spec.Issuer)
+		discoveredProvider, err = coreosoidc.NewProvider(coreosoidc.ClientContext(ctx, httpClient), upstream.Spec.Issuer)
 		if err != nil {
 			c.log.V(plog.KlogLevelTrace).WithValues(
 				"namespace", upstream.Namespace,
@@ -457,12 +458,12 @@ func defaultClientShortTimeout(rootCAs *x509.CertPool) *http.Client {
 func computeScopes(additionalScopes []string) []string {
 	// If none are set then provide a reasonable default which only tries to use scopes defined in the OIDC spec.
 	if len(additionalScopes) == 0 {
-		return []string{"openid", "offline_access", "email", "profile"}
+		return []string{oidcapi.ScopeOpenID, oidcapi.ScopeOfflineAccess, oidcapi.ScopeEmail, oidcapi.ScopeProfile}
 	}
 
 	// Otherwise, first compute the unique set of scopes, including "openid" (de-duplicate).
 	set := sets.NewString()
-	set.Insert("openid")
+	set.Insert(oidcapi.ScopeOpenID)
 	for _, s := range additionalScopes {
 		set.Insert(s)
 	}

internal/controller/supervisorstorage/garbage_collector.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"time"
 
-	coreosoidc "github.com/coreos/go-oidc/v3/oidc"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/labels"
@@ -17,8 +16,8 @@ import (
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/utils/clock"
 	clocktesting "k8s.io/utils/clock/testing"
-	"k8s.io/utils/strings/slices"
 
+	oidcapi "go.pinniped.dev/generated/latest/apis/supervisor/oidc"
 	pinnipedcontroller "go.pinniped.dev/internal/controller"
 	"go.pinniped.dev/internal/controllerlib"
 	"go.pinniped.dev/internal/crud"
@@ -204,7 +203,7 @@ func (c *garbageCollectorController) maybeRevokeUpstreamOIDCToken(ctx context.Co
 			return err
 		}
 		pinnipedSession := accessTokenSession.Request.Session.(*psession.PinnipedSession)
-		if slices.Contains(accessTokenSession.Request.GetGrantedScopes(), coreosoidc.ScopeOfflineAccess) {
+		if accessTokenSession.Request.GetGrantedScopes().Has(oidcapi.ScopeOfflineAccess) {
 			return nil
 		}
 		return c.tryRevokeUpstreamOIDCToken(ctx, pinnipedSession.Custom, secret)

internal/controller/supervisorstorage/garbage_collector_test.go

@@ -263,13 +263,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there are valid, expired authcode secrets which contain upstream refresh tokens", func() {
 			it.Before(func() {
 				activeOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -307,13 +308,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				r.NoError(kubeClient.Tracker().Add(activeOIDCAuthcodeSessionSecret))
 
 				inactiveOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  false,
 					Request: &fosite.Request{
 						ID:     "request-id-2",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -385,13 +387,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there are valid, expired authcode secrets which contain upstream access tokens", func() {
 			it.Before(func() {
 				activeOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -429,13 +432,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				r.NoError(kubeClient.Tracker().Add(activeOIDCAuthcodeSessionSecret))
 
 				inactiveOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  false,
 					Request: &fosite.Request{
 						ID:     "request-id-2",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -507,13 +511,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there is an invalid, expired authcode secret", func() {
 			it.Before(func() {
 				invalidOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "", // it is invalid for there to be a missing request ID
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -575,13 +580,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there is a valid, expired authcode secret but its upstream name does not match any existing upstream", func() {
 			it.Before(func() {
 				wrongProviderNameOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name-will-not-match",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -645,13 +651,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there is a valid, expired authcode secret but its upstream UID does not match any existing upstream", func() {
 			it.Before(func() {
 				wrongProviderNameOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid-will-not-match",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -715,13 +722,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there is a valid, recently expired authcode secret but the upstream revocation fails", func() {
 			it.Before(func() {
 				activeOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -819,13 +827,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there is a valid, long-since expired authcode secret but the upstream revocation fails", func() {
 			it.Before(func() {
 				activeOIDCAuthcodeSession := &authorizationcode.Session{
-					Version: "2",
+					Version: "3",
 					Active:  true,
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -897,13 +906,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there are valid, expired access token secrets which contain upstream refresh tokens", func() {
 			it.Before(func() {
 				offlineAccessGrantedOIDCAccessTokenSession := &accesstoken.Session{
-					Version: "2",
+					Version: "3",
 					Request: &fosite.Request{
 						GrantedScope: fosite.Arguments{"scope1", "scope2", "offline_access"},
 						ID:           "request-id-1",
 						Client:       &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -941,13 +951,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				r.NoError(kubeClient.Tracker().Add(offlineAccessGrantedOIDCAccessTokenSessionSecret))
 
 				offlineAccessNotGrantedOIDCAccessTokenSession := &accesstoken.Session{
-					Version: "2",
+					Version: "3",
 					Request: &fosite.Request{
 						GrantedScope: fosite.Arguments{"scope1", "scope2"},
 						ID:           "request-id-2",
 						Client:       &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -1019,13 +1030,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there are valid, expired access token secrets which contain upstream access tokens", func() {
 			it.Before(func() {
 				offlineAccessGrantedOIDCAccessTokenSession := &accesstoken.Session{
-					Version: "2",
+					Version: "3",
 					Request: &fosite.Request{
 						GrantedScope: fosite.Arguments{"scope1", "scope2", "offline_access"},
 						ID:           "request-id-1",
 						Client:       &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -1063,13 +1075,14 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 				r.NoError(kubeClient.Tracker().Add(offlineAccessGrantedOIDCAccessTokenSessionSecret))
 
 				offlineAccessNotGrantedOIDCAccessTokenSession := &accesstoken.Session{
-					Version: "2",
+					Version: "3",
 					Request: &fosite.Request{
 						GrantedScope: fosite.Arguments{"scope1", "scope2"},
 						ID:           "request-id-2",
 						Client:       &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -1141,12 +1154,13 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there are valid, expired refresh secrets which contain upstream refresh tokens", func() {
 			it.Before(func() {
 				oidcRefreshSession := &refreshtoken.Session{
-					Version: "2",
+					Version: "3",
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,
@@ -1217,12 +1231,13 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
 		when("there are valid, expired refresh secrets which contain upstream access tokens", func() {
 			it.Before(func() {
 				oidcRefreshSession := &refreshtoken.Session{
-					Version: "2",
+					Version: "3",
 					Request: &fosite.Request{
 						ID:     "request-id-1",
 						Client: &clientregistry.Client{},
 						Session: &psession.PinnipedSession{
 							Custom: &psession.CustomSessionData{
+								Username:     "should be ignored by garbage collector",
 								ProviderUID:  "upstream-oidc-provider-uid",
 								ProviderName: "upstream-oidc-provider-name",
 								ProviderType: psession.ProviderTypeOIDC,