feat: add configurable OIDC authentication for enterprise deployments

[rrbanda]

Summary

Adds optional, provider-agnostic OIDC authentication to ADK Web UI for enterprise deployments where agents are managed by platforms like Kagenti with SPIFFE/SPIRE zero-trust security.

• Opt-in: Auth disabled by default. Zero impact on existing users.
• Provider-agnostic: Uses oidc-client-ts (standard OIDC). Works with Keycloak, Okta, Auth0, Azure AD, or any OIDC-compliant provider.
• Runtime-configurable: Enable auth via runtime-config.json or Kubernetes ConfigMap -- no image rebuild needed.
• Fail-closed security: When auth is enabled but token is unavailable, requests are blocked rather than sent without credentials.
• PKCE enforced: Authorization Code flow with Proof Key for Code Exchange.
• Angular 21 patterns: provideAppInitializer, functional interceptor via provideHttpClient(withInterceptors([...])), functional route guard.

New files

• src/app/core/auth/ -- AuthService (oidc-client-ts UserManager), functional HTTP interceptor, route guard, config resolver with Window type augmentation
• src/app/components/user-menu/ -- Authenticated user menu component (name, email, roles from JWT, logout)
• src/silent-check-sso.html -- Silent token refresh for background renewal
• deploy/ -- Dockerfile (multi-stage, non-root nginx) and OpenShift manifests with ConfigMap-based auth config
• 5 Karma/Jasmine spec files following existing initTestBed() pattern

Modified files

• src/main.ts -- provideAppInitializer for auth init, provideHttpClient with functional interceptor, visible error on bootstrap failure
• src/app/app-routing.module.ts -- Auth guard on root route
• src/app/components/chat/ -- Conditionally show auth user menu vs original user ID editor
• src/app/core/services/agent.service.ts -- Bearer token on SSE fetch, response.ok check before reading stream
• src/app/core/models/RuntimeConfig.ts -- AuthConfig interface (authority, clientId, scopes)
• README.md -- Authentication section with setup guide, supported providers, ConfigMap injection, Kagenti/SPIFFE integration

Configuration example

{
  "backendUrl": "http://localhost:8000",
  "auth": {
    "enabled": true,
    "authority": "https://keycloak.example.com/realms/my-realm",
    "clientId": "adk-web-ui"
  }
}

Provider	Authority URL
Keycloak	https://keycloak.example.com/realms/{realm}
Okta	https://dev-{id}.okta.com
Auth0	https://{tenant}.auth0.com
Azure AD	https://login.microsoftonline.com/{tenant}/v2.0

Security model

Browser --OIDC--> Identity Provider --JWT--> Browser
   | Authorization: Bearer <JWT>
Envoy AuthBridge (Kagenti sidecar, validates JWT) --> ADK Agent
   | SPIFFE/SPIRE mTLS (automatic via ztunnel)
Backend Services (SonataFlow, MCP servers)

Design decisions

• oidc-client-ts over keycloak-js: Provider-agnostic, standard OIDC, smaller surface, no Keycloak-specific config (realm in adapter)
• Functional interceptor over class-based: APP_INITIALIZER is deprecated in Angular 21; provideHttpClient(withInterceptors([fn])) is the modern pattern
• Fail-closed: Missing token throws error rather than sending unauthenticated request -- prevents ambiguous 401/403 from backend
• Idempotent init: AuthService.init() deduplicates concurrent calls via stored promise
• WebSocket auth: Removed query-param token (log/referrer leakage risk); documented as known limitation requiring server-side protocol changes

Test plan

• Auth disabled (default): UI loads without login, all existing behavior unchanged
• Auth enabled with real Keycloak (Kagenti realm): OIDC redirect, login, token exchange, user menu with name/email/roles, logout
• Agent prompts work with auth enabled (session creation, SSE streaming, tool calls, LLM response)
• Build passes (npx ng build) with zero new errors
• Unit tests: auth.service, auth.interceptor, auth.guard, auth.config, user-menu component
• Tested on OpenShift with containerized image (quay.io), ConfigMap auth config, and real Keycloak
• No secrets or environment-specific values in committed code
• Apache 2.0 license headers on all new files, copyright year consistent (2025)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.