sources/oauth: OIDC well-known and JWKS (#2936)

* add initial

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add provider

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* include source and jwk key id in event

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add more docs

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add tests for source

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* fix web formatting

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add provider tests

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* fix lint error

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

website/docs/flow/executors/user-settings.md

@@ -3,7 +3,7 @@ title: User settings
 ---
 
 :::info
-Requires authentik 2022.3.1
+Requires authentik 2022.3
 :::
 
 The user interface (`/if/user/`) embeds a downsized flow executor to allow the user to configure their profile using custom stages and prompts.

website/docs/providers/oauth2/client_credentials.md

@@ -31,6 +31,10 @@ Starting with authentik 2022.4, you can authenticate and get a token using an ex
 
 To configure this, the certificate used to sign the input JWT must be created in authentik. The certificate is enough, a private key is not required. Afterwards, configure the certificate in the OAuth2 provider settings under _Verification certificates_.
 
+:::info
+Starting with authentik 2022.6, you can define a JWKS URL/raw JWKS data in OAuth Sources, and use those to verify the key instead of having to manually create a certificate in authentik for them. This method is still supported but will be removed in a later version.
+:::
+
 With this configure, any JWT issued by the configured certificates can be used to authenticate:
 
 ```

website/docs/releases/v2022.6.md

@@ -0,0 +1,32 @@
+---
+title: Release 2022.6
+slug: "2022.6"
+---
+
+## Breaking changes
+
+## New features
+
+-   Added well-known and JWKS URL in OAuth Source
+
+    These fields can be used to automatically configure OAuth Sources based on the [OpenID Connect Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html). Additionally, you can manually define a JWKS URL or raw JWKS data, and this can be used for Machine-to-machine authentication for OAuth2 Providers.
+
+## Minor changes/fixes
+
+## Upgrading
+
+This release does not introduce any new requirements.
+
+### docker-compose
+
+Download the docker-compose file for 2022.6 from [here](https://goauthentik.io/version/2022.6/docker-compose.yml). Afterwards, simply run `docker-compose up -d`.
+
+### Kubernetes
+
+Update your values to use the new images:
+
+```yaml
+image:
+    repository: ghcr.io/goauthentik/server
+    tag: 2022.6.1
+```

website/integrations/sources/oauth/index.md

@@ -16,3 +16,21 @@ This source allows users to enroll themselves with an external OAuth-based Ident
 -   Access Token URL: This value will be provided by the provider.
 -   Profile URL: This URL is called by authentik to retrieve user information upon successful authentication.
 -   Consumer key/Consumer secret: These values will be provided by the provider.
+
+### OpenID Connect
+
+:::info
+Requires authentik 2022.6
+:::
+
+#### Well-known
+
+Instead of configuring the URLs for a source manually, and the application you're configuring implements the [OpenID Connect Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html), you can configure the source with a single URL. The URL should always end with `.well-known/openid-configuration`. Many applications don't explicitly mention this URL, but for most of them it will be `https://application.company/.well-known/openid-configuration`.
+
+This URL is fetched upon saving the source, and all the URLs will be replaced by the ones from the Discovery document. No automatic re-fetching is done.
+
+#### JWKS
+
+To simplify Machine-to-machine authentication, you can create an OAuth Source as "trusted" source of JWTs. Create a source and configure either the Well-known URL or the OIDC JWKS URL, or you can manually enter the JWKS data if you so desire.
+
+Afterwards, this source can be selected in one or multiple OAuth2 providers, and any JWT issued by any of the configured sources' JWKS will be able to authenticate. To learn more about this, see [JWT-authentication](/docs/providers/oauth2/client_credentials#jwt-authentication).