Remaining to-dos from SSO PR

[matthew-white]

The SSO PR #910 was merged earlier today. 🎉 This issue is to track comments and any other to-dos from the PR that are still open.

I'm going to copy some to-dos that @alxndrsn mentioned on Slack. @alxndrsn, please feel free to edit or add to the list below! CC also @sadiqkhoja: feel free to leave a comment if there are other to-dos from the PR.

If it'd be helpful, I also think that any of these to-dos could be split into separate issues.

• Support Single Sign-on with OpenID Connect #910 (comment) - filed at oidc: csp: style-src-elem directive violated on login #1221
• Support Single Sign-on with OpenID Connect #910 (comment)
• https://github.com/getodk/central-backend/pull/910/files#r1311013042
• https://github.com/getodk/central-backend/pull/910/files#r1311024572
• Support Single Sign-on with OpenID Connect #910 (comment)

Moving code around

• Support Single Sign-on with OpenID Connect #910 (comment) - filed at Refactor createUserSession() #1222
• https://github.com/getodk/central-backend/pull/910/files#r1310996344

More in-depth refactor

• Support Single Sign-on with OpenID Connect #910 (comment) - filed at tests/oidc: refactor authenticateUser() #1223

Tracked elsewhere

• https://github.com/getodk/central-backend/pull/910/files#r1310995967 / Support Single Sign-on with OpenID Connect #910 (comment)
  • SSO: render simple redirect page rather than copying Frontend styles #971

[matthew-white]

I can make a note of this in #588, but I thought I'd mention that oidc-e2e-test failed once for me: https://github.com/getodk/central-backend/actions/runs/6218293098/attempts/1. When I reran it, it passed.

[alxndrsn]

@matthew-white I've also seen these intermittent failures and in integration tests. I suspect an issue in the fake-oidc-server, but we can't currently see the logs. I'll see if it's simple to add the logs to the github actions.

[alxndrsn]

@matthew-white actually the logs seem to be available already.

From the failure screenshot on your job, it looks like playwright/webkit interaction failure:

It's clear the password has ended up in the wrong input field.

[alxndrsn]

There's a very similar bug filed at microsoft/playwright#26349, but without much detail.

[alxndrsn]

@matthew-white the other option is to enable retries for the playwright tests. Less red builds, but also it will mask real problems 🤷

[alxndrsn]

I've opened separate issues for the remaining tasks:

• oidc: csp: style-src-elem directive violated on login #1221
• Refactor createUserSession() #1222
• tests/oidc: refactor authenticateUser() #1223