Replace OpenID 2.0 with OAuth 2.0/OIDC login

[mraible]

Stacked on #154 (1/3 in the stack); after it merges, this retargets to master. Replaces the obsolete OpenID 2.0 authentication (removed in Spring Security 6) with OAuth 2.0/OIDC login using spring-security-oauth2-client. Phase 3 of the Jakarta EE 10 migration (ROL-2183).

Removed / changed behavior — read before merging:

• The openid and db-openid values of authentication.method no longer exist; configs using them must move to oidc or db-oidc. OpenID 2.0 relay support does not survive in any form (the protocol is dead and Spring Security dropped it upstream).
• users.oidc.autoProvision.enabled defaults to false, matching users.ldap.autoProvision.enabled: only pre-created accounts, or accounts the provider links via a verified matching email, can sign in until it is enabled. The docker demo turns it on (override with OIDC_AUTO_PROVISION=false). Linking to an existing account always requires the provider to assert a verified email matching that account.
• Security note: users.firstUserAdmin would have handed the admin role to whichever provider user reached a fresh install first. Auto-provisioned accounts no longer keep that bootstrap grant unless the provider asserts an admin role claim or the new users.oidc.firstUserAdmin property (default false) is enabled; the revocation is logged with the alternatives.
• authentication.method is now enforced server side, not just in the UI: under db, ldap, and cma no provider registrations are served and the OIDC flow is rejected outright, and under pure oidc the form login refuses password lookups. db-oidc allows both.
• A confidential client without a client-secret is rejected at configuration time with a clear log message; oidc.{id}.client-authentication-method=none supports public clients using PKCE.
• Provider discovery is cached per provider with a bounded retry backoff, so one unreachable identity provider does not block the others or turn login-page rendering into repeated discovery attempts.
• OAuth2/OIDC failures redirect with their own error=oidc marker, so the login page reports them as provider failures instead of a wrong password.
• docker-compose now defaults AUTHENTICATION_METHOD to oidc, so the demo signs in through the bundled Keycloak by default; set db for the old form-login demo or db-oidc for both side by side.
• This adds OAuth 2.0 for browser login only. It does not restore the AtomPub API's removed OAuth 1.0a option (see ROL-2183: Migrate from javax to Jakarta EE 11 #154); AtomPub remains basic/wsse.

How it works:

• RollerClientRegistrationRepository reads provider config (client-id, client-secret, issuer-uri) from Roller properties, with OIDC discovery at startup
• RollerOidcUserService resolves the Roller account behind an authenticated OIDC user via the existing openIdUrl column (stores issuer#sub) and provisions accounts just in time, so the principal carries Roller roles from the first request
• The returned principal is named after the resolved Roller account. Roller looks users up by principal name throughout (rendering models, filters, Struts actions), and the default OidcUser name is the opaque sub claim, which made every rendered weblog page fail with a Velocity error for signed-in OIDC users
• AuthMethod gains OIDC/DB_OIDC, and Login.jsp shows provider buttons built from the resolved registrations, so it never advertises a provider whose discovery failed
• docker-compose gains Keycloak seeded with admin/admin and user/user, and the image builds from the working tree instead of a cloned release tag
• 19 unit tests cover the new classes, including regressions for the principal name and the provisioning policy

To try it: add 127.0.0.1 keycloak to /etc/hosts, then docker compose up -d and log in at http://localhost:8080/ as admin/admin or user/user.

[Copilot]

Pull request overview

Replaces obsolete OpenID 2.0 browser authentication with OAuth 2.0/OIDC, including account linking, provisioning, provider discovery, and local Keycloak support.

Changes:

• Adds OIDC login, Roller principal/role integration, and tests.
• Updates authentication configuration and login UI.
• Adds a Keycloak-backed Docker Compose demo.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
Dockerfile	Builds Roller from the working tree.
.dockerignore	Excludes local build data.
docker-compose.yml	Adds Keycloak and OIDC defaults.
docker/entry-point.sh	Writes OIDC runtime properties.
docker/realm-config/roller-realm.json	Seeds the demo realm and users.
docker/realm-config/keycloak-health-check.sh	Checks Keycloak readiness.
app/pom.xml	Adds OAuth2/OIDC dependencies.
AuthMethod.java	Replaces OpenID authentication modes.
RollerContext.java	Exposes registrations and adjusts PBKDF2 compatibility.
RollerSession.java	Resolves sessions by OIDC subject.
RollerClientRegistrationRepository.java	Discovers configured OIDC providers.
RollerOidcUserService.java	Links and provisions Roller users.
RollerOAuth2SuccessHandler.java	Redirects successful OIDC logins.
Login.java	Supplies provider data to the login page.
Register.java	Handles OIDC external-auth registration.
Profile.java	Updates OIDC profile behavior.
ProfileBean.java	Exposes issuer and subject fields.
UserEdit.java	Updates OIDC administration behavior.
security.xml	Configures Spring Security OIDC login.
Login.jsp	Renders provider sign-in buttons.
roller.properties	Documents OIDC configuration and provisioning.
ApplicationResources.properties	Adds OIDC UI messages.
RollerOidcUserServiceTest.java	Tests linking, provisioning, and roles.
RollerOAuth2SuccessHandlerTest.java	Tests post-login redirects.
RollerClientRegistrationRepositoryTest.java	Tests registration configuration handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.