github connector

[klizhentas]

Description

We want to support github SSO natively. Github is not OIDC, but OAuth 2.0.

kind: github
version: v3
metadata:
  name: Gravitational Connector to Github
spec:
  # these are for Github OAuth 2.0 to work:
  redirect_url: https://localhost:3080/v1/webapi/github/callback
  client_id: client it
  client_secret: client secret

  # this map matches user's Github membership to a Teleport role
  teams_to_roles:
    - {organization: "gravitational", team: "interns", roles: ["interns"]}
    - {organization: "rackspace", team: "ssh-users", roles: ["users", "interns"]}

OSS version only has one role: "admins", so it would be nice for tctl create github-connector.yaml to print a warning if a user tries to set up a mapping for a non-existent group [useful for all connectors, actually].

Here is the flow:

• User authenticates, we requrest teams scope for user to read team memberships.
• We read team memberships, and map teams to user traits property that we have defined.

The rest of the flow is completely identical to the OIDC authentication. The only difference is that we populate "claims" by calling API of github directly.

This will give us flexibility to add different types of claims, e.g. repository based claims and real claims when they arrive.

Ev: edits

Update: [@r0mant] After discussion with @kontsevoy renamed "groups" to "teams" in resource spec to be consistent with Github terminology.

[kontsevoy]

Meeting note: @klizhentas to think about the versioning theme, i.e. limit the version attribute specific to structure, or have a global "latest version"