Remove access_token hiding hack from helusername backend

[vikoivun]

Remove a hack to work around a bug in python-jose and upgrade to a fixed version of python-jose.

Keycloak 9.x issued ID-tokens without at_hash claim during authorization code flow. This caused the buggy library to reject the token. See mpdavis/python-jose#75

Newer versions of Keycloak started to include the claim even during authorization code flow, which masked the bug.

[codecov]

Codecov Report

Merging #161 (4b2dbb8) into develop (bd2ceaa) will increase coverage by 0.01%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##           develop     #161      +/-   ##
===========================================
+ Coverage    86.10%   86.11%   +0.01%     
===========================================
  Files          150      150              
  Lines         5576     5574       -2     
===========================================
- Hits          4801     4800       -1     
+ Misses         775      774       -1     

Impacted Files	Coverage Δ
auth_backends/helsinki_username.py	100.00% <ø> (+12.50%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bd2ceaa...4b2dbb8. Read the comment docs.

[mikkokeskinen]

Could the python-jose version be set in the requirements.in and running pip-compile?

Like so:
python-jose>=3.2.0

[vikoivun]

Could the python-jose version be set in the requirements.in and running pip-compile?

Like so:
python-jose>=3.2.0

Well, it is a transitive dependency. I'm hoping social-core will get back into business and update their dependencies. At least the project recently got a new maintainer.

[mikkokeskinen]

Yes I know. But if it's our need that the version should be newer, we should maybe set it in our requirements?

[mikkokeskinen]

Btw. python-jose 3.2.0 brings other updates that are not now in the requirements.txt.

[vikoivun]

Btw. python-jose 3.2.0 brings other updates that are not now in the requirements.txt.

Fair enough. I'll push the changes to requirements.in

[mikkokeskinen]

👍