Simplification of OAuth authorization credentials

[costrouc]

Take the following qhub-hpc configuration. It would be nice if less boilerplate was needed.

c.GenericOAuthAuthentication.access_token_url = "https://{{ traefik_domain | default(hostvars[groups['hpc-master'][0]].ansible_host) }}/auth/realms/{{ keycloak_realm }}/protocol/openid-connect/token"
c.GenericOAuthAuthentication.authorize_url = "https://{{ traefik_domain | default(hostvars[groups['hpc-master'][0]].ansible_host) }}/auth/realms/{{ keycloak_realm }}/protocol/openid-connect/auth"
c.GenericOAuthAuthentication.user_data_url = "https://{{ traefik_domain | default(hostvars[groups['hpc-master'][0]].ansible_host) }}/auth/realms/{{ keycloak_realm }}/protocol/openid-connect/userinfo"
c.GenericOAuthAuthentication.oauth_callback_url = "https://{{ traefik_domain | default(hostvars[groups['hpc-master'][0]].ansible_host) }}/conda-store/oauth_callback"
c.GenericOAuthAuthentication.client_id = "{{ conda_store_client_id }}"
c.GenericOAuthAuthentication.client_secret = "{{ conda_store_client_secret }}"
c.GenericOAuthAuthentication.access_scope = "profile"
c.GenericOAuthAuthentication.user_data_key = "preferred_username"
c.GenericOAuthAuthentication.tls_verify = False

import requests
from conda_store_server import schema, api, orm
from conda_store_server.server.utils import get_conda_store

class KeyCloakAuthentication(GenericOAuthAuthentication):
    def authenticate(self, request):
        # 1. using the callback_url code and state in request
        oauth_access_token = self._get_oauth_token(request)
        if oauth_access_token is None:
            return None  # authentication failed

        response = requests.get(
            self.user_data_url,
            headers={"Authorization": f"Bearer {oauth_access_token}"},
            verify=self.tls_verify,
        )
        response.raise_for_status()
        user_data = response.json()

        role_mappings = {
            'conda_store_admin': 'admin',
            'conda_store_developer': 'developer',
            'conda_store_viewer': 'viewer',
        }
        roles = {role_mappings[role] for role in user_data.get('roles', []) if role in role_mappings}
        username = user_data['preferred_username']
        namespaces = {username, 'default', 'filesystem'}
        role_bindings = {
            f'{username}/*': {'admin'},
            f'filesystem/*': {'reader'},
            f'default/*': roles,
        }

        for group in user_data.get('groups', []):
            namespaces.add(group)
            role_bindings[f'{group}/*'] = roles

        conda_store = get_conda_store()
        for namespace in namespaces:
            _namespace = api.get_namespace(conda_store.db, name=namespace)
            if _namespace is None:
                conda_store.db.add(orm.Namespace(name=namespace))
                conda_store.db.commit()

        return schema.AuthenticationToken(
            primary_namespace=username,
            role_bindings=role_bindings,
        )

c.CondaStoreServer.authentication_class = KeyCloakAuthentication