OpenID Connect support

[fhennig]

Out-of-the-box, Superset does not have OpenID Connect (OIDC) support. It does however support OAuth 2.0, and OIDC providers like Keycloak provide OAuth 2.0 support as well, so Superset can be configured to work with that.

Direct support for OIDC would require adding an addtional dependency to the Docker image and modifying some code. the code changes would also be on a security-critical path and we would need to be aware of upstream modifications each update. It would be a difficult route to go down I believe.

useful Stackoverflow question - our docs on the topic

[lfrancke]

Does this contain a CRD change? If so: Is it breaking?

[siegfriedweber]

@lfrancke Yes, there is a CRD change. An oidc property was added to the authentication entries, which is only required if an OIDC AuthenticationClass is provided, see https://docs.stackable.tech/home/nightly/contributor/adr/adr032-oidc-support#_product_cluster_configuration_design. So this change is not breaking.