Testing with ms entra

[davidpcls]

Description

This includes the changes needed to get this working with MS Entra. These changes would have been necessary regardless of the authenticator and much of the code closely resembles what exists in tiled's authentication.py file.

This will support both client credential flow and device auth flows.

Motivation and Context

We wanted support for Entra.

Summary of Changes for Release Notes

Added endpoints required to properly support OIDC authentication flows.

Fixed

Added

Added endpoints required to properly support OIDC authentication flows.

Changed

Removed

How Has This Been Tested?

Tested using MS entra and an authorized application setup in Azure. The application was configured
with the following redirect URLS:

• http://localhost:60610/api/auth/provider/entra/code
• http://localhost:60610/api/auth/provider/entra/device_code

And then the following config setup for the HTTPserver:

authentication:
  providers:
    - provider: entra
      authenticator: bluesky_httpserver.authenticators:OIDCAuthenticator
      args:
        audience: <from Azure application registration>
        client_id: <from Azure application registration>
        client_secret: ${ENTRA_SECRET}
        well_known_uri: https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
        confirmation_message: "You have logged in successfully."

api_access:
  policy: bluesky_httpserver.authorization:DictionaryAPIAccessControl
  args:
    users:
      <an entra user>:
        roles:
          - admin
          - expert

Then it was possible to login using this endpoint

http POST http://localhost:60610/api/auth/provider/entra/authorize

and also with the latest queueserver-api changes to support external auth.

[davidpcls]

The last run of the unit tests showed what appeared to be a unit test design issue and not something related to the tests I added. I think.