Make OAuth secrets and settings configurable

[liggitt]

• Add structure and validation around session secrets
• Switch session secret from time-based uuid to hash of random uuid
• Generate default signing and encrypting secrets
• Optionally externalize secrets using a file ref to a serialized SessionSecrets object
• Update OAuth config documentation

[liggitt]

@deads2k @detiber review and critique, please

Two ways to configure session secrets:

1 - No config, default generated by --write-config. We generate a random secret on startup. A server restart invalidates any current sessions (they are only used during the actual login process). Only good for single-server deployments (multiple masters wouldn't agree on signed sessions).

oauthConfig:
  ...
  sessionConfig:
    ...
    sessionSecretsFile: ""

2 - Externalized config:

oauthConfig:
  ...
  sessionConfig:
    ...
    sessionSecretsFile: "mysecrets.yaml"

mysecrets.yaml:

apiVersion: v1
kind: SessionSecrets
secrets:
- authentication: ...
  encryption: ...
...

[openshift-bot]

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pull_requests_openshift3/1729/)

[liggitt]

@detiber hold off on looking at this... reworking some stuff after talking with @deads2k

[deads2k]

I'm anti-space.

[liggitt]

reworked to produce errors like this:

oauthConfig.sessionConfig.sessionSecretsFile: invalid value 'secrets.yaml': secrets[0].encryption: invalid value '*********************************': must be 16, 24, or 32 characters long

[deads2k]

Nits. lgtm.

[liggitt]

Added integration test to make sure we can start with OAuth disabled and cert auth still works.

[merge]

[openshift-bot]

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_openshift3/1500/) (Image: devenv-fedora_1226)

[liggitt]

Spurious, re[merge]

@ncdc not sure if this is related to image changes... looks like test-cmd.sh failed around this call:

Error: error executing template '{{.status.tags.latest}}': 'template: output:1:9: executing "output" at <.status.tags.latest>: can't evaluate field latest in type interface {}'
----data----
map[apiVersion:v1beta1 metadata:map[selfLink:/osapi/v1beta1/imageStreams/wildfly-8-centos?namespace=default uid:8ab90a6a-dd5a-11e4-be42-22000a658678 resourceVersion:145 creationTimestamp:2015-04-07T19:16:07Z annotations:map[openshift.io/image.dockerRepositoryCheck:2015-04-07T19:16:11Z] name:wildfly-8-centos namespace:default] spec:map[dockerImageRepository:openshift/wildfly-8-centos] status:map[dockerImageRepository:openshift/wildfly-8-centos tags:[map[tag:latest items:[map[dockerImageReference:openshift/wildfly-8-centos:latest image:9d0e595e08eb304b0dcfacd2cf96d384c70dd94cb2d6691ff7ba96a7642593e6 created:2015-04-07T19:16:08Z]]]]] kind:ImageStream]

[openshift-bot]

Evaluated for origin up to 4457e6f