Keycloak integration

[ali-everest]

Proposed changes

Replace the Spring Security OAuth with Keycloak.
Keycloak is an open source identity and access management solution. It will take care of handling the authentication and authorisation part. No extra maintenance is required. It will take care of managing the user details and sessions information etc,.

Checklist

• My local build passed (You ran ./gradlew clean build without failures)
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)
• I have assigned a label to the PR

[sluehr]

This would close lhotse#30, close lhotse#43 and close lhotse#33

Also deprecates the security module which can then be archived.

Once merged, allows for all dependencies to be brought up to date.

[sluehr]

More to come later....

[sluehr]

Functionality is broken. It is not possible to self register yourself.

[ywangd]

It's a big PR. I didn't read everything. Here are some comments before I can commit more time to read it again.

One question that I have is about how keycloak should be positioned in the architecture, or more specifically, the command/event flow. My take is that keycloak should still be secondary because it is not the core of the business model. The principle is that we should be able to rebuild it as long as we have the full events. With the proposed changes, it seems that passwords are known only to keycloak and bypass the core application. This means we cannot replay events for full recovery. The code currently does not deal with user roles, but I believe it would have the similar issue with the current approach.

[sluehr]

We have some remaining issues before we can close this off and start picking up the issues that we have identified as part of this review:

• every time a user visits the site we trigger the process to create a default organisation for them
• APIs are dispatching commands to aggregates that do not exist. User/org IDs are not being validated like they were in the past due to the underlying authentication changes
• The account created in Keycloak through the application admin flow cannot be used to log in because the password is never set and the account is missing something else. Attempting to login gives me "account not fully set up".

The first two points need some changes applied to avoid the issues.

The third point I think we can resolve by removing the "admin does a thing for you" flow.