Keycloak support for public clients and device flow (enables sigstore)

[Racer159]

Is your feature request related to a problem? Please describe.

As Kay I want to have Sigstore integrated with Keycloak so that I can sign images, git commits and more without needing to manage keys

Describe the solution you'd like

• Given I have an image I want to sign
• And the Sigstore stack is available in my environment
• When I run something like cosign sign with the fulcio, rekor, and oidc-issuer urls
• Then I am taken through the Keycloak signin process (device flow)
• And the action completes without needing a client secret

Describe alternatives you've considered

We could not integrate with Keycloak directly and instead use something like Dex to issue the id tokens: https://dexidp.io/

Additional context

Currently the uds-core operator does not allow the creation of clients without a client secret.

[bburky]

I discussed localhost:* in defenseunicorns/uds-identity-config#115 (comment). I would instead recommend using the device flow.

The second part does make sense. A "client without a secret" is a "public" client in Keycloak terms (in contrast to a "confidential" client). The pepr UDS operator could be extended to support this. This is fine... but we really do need to review the impact of introducing "public" clients into UDS. They really don't make any thing worse but do kind of make some existing bugs easier to exploit.

• That would be the (only?) public client, need to understand the side effects. This would probably be one of the few ways currently that an end user can get their hands on a JWT (authservice hides it from you)
• If users can get JWTs and depending on some other code... we need to make sure we check aud everywhere, so that these JWTs can't incorrectly be used to log into other stuff (we don't yet check aud in the authservice code but I'm already recommending to add it, I'm unsure what most apps like GitLab etc do)
• I think the OIDC token API may bypass the group protection code (feat: group authorization plugin uds-identity-config#111) we're doing... I can probably fix that now

[Racer159]

Added to the SWF board as well in case we get to it - this isn't the main use case for sigstore but it is a nice thing to enable for flexibility for users.