frontend: discover OIDC authorization and token endpoints

[HarryKodden]

Summary

dCache View OIDC login no longer requires hand-copied authorization and token URLs. When an issuer is configured, the frontend loads {issuer}/.well-known/openid-configuration and uses authorization_endpoint (View login page) and token_endpoint (code-flow callback).

Explicit frontend.static!dcache-view.oidc-authz-endpoint-list and frontend.authn.oidc.token-url still win over discovery.

Configuration

Single provider:

frontend.authn.oidc.issuer = https://op.example.org
frontend.authn.oidc.client-id = <client-id>
frontend.authn.oidc.client-secret = <client-secret>
frontend.static!dcache-view.oidc-provider-name-list = ExampleOP
frontend.static!dcache-view.oidc-client-id-list = <client-id>

Several providers: set frontend.static!dcache-view.oidc-issuer-list in the same order as the name and client-id lists. The code-flow token exchange still uses one token endpoint (frontend.authn.oidc.issuer / frontend.authn.oidc.token-url).

Notes

• Discovery URL construction matches gPlazma (IdentityProvider), including issuers with a path.
• Documents are cached after the first successful fetch.
• Book and frontend.properties describe the new properties.

Test plan

• Unit tests: OidcDiscoveryTest (URL building, cache, explicit override, missing issuer)
• Single OP: set only frontend.authn.oidc.issuer; View login and /api/v1/auth/callback succeed
• Explicit oidc-authz-endpoint-list / token-url still override discovery
• Issuer with a path (e.g. https://host/oauth2) resolves .../oauth2/.well-known/openid-configuration

[HarryKodden]

The GitHub sync failure is not from this change. mirror-rp.yml uses pull_request_target and checks out the fork head; actions/checkout now refuses that unless maintainers set allow-unsafe-pr-checkout: true (or change the trigger) on master. See https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/

[kofemann]

@HarryKodden, thanks for the contribution. The GitHub sync failure is expected (and intended), as external contributors don't have access to our auth token. Pleas sign our commit with Signed-of-by: as described in https://github.com/dCache/dcache/blob/master/CONTRIBUTING.md#external-contribution-formalities.

[HarryKodden]

Thanks — Signed-off-by is on the commit now. I understand the GitHub sync failure is expected for fork PRs.