TLS configure for OIDC connector

[xtremerui]

This PR adds two configurable fiels RootCAs and InsecureSkipVerify to OIDC connector. When openning a connection to OIDC connect provider, it will use a httpclient based on these two fields.

[xtremerui]

@sagikazarmark just a quick raincheck here to see if this PR falls in the path. I am seeing some connectors providing TLS config (more or less). For example,

Github:

dex/connector/github/github.go

Lines 99 to 108 in 6cdbb59

	if c.RootCA != "" {
	if c.HostName == "" {
	return nil, errors.New("invalid connector config: Host name field required for a root certificate file")
	}
	g.rootCA = c.RootCA
	var err error
	if g.httpClient, err = newHTTPClient(g.rootCA); err != nil {
	return nil, fmt.Errorf("failed to create HTTP client: %v", err)
	}

LDAP:

dex/connector/ldap/ldap.go

Lines 255 to 269 in 6cdbb59

	tlsConfig := &tls.Config{ServerName: host, InsecureSkipVerify: c.InsecureSkipVerify}
	if c.RootCA != "" || len(c.RootCAData) != 0 {
	data := c.RootCAData
	if len(data) == 0 {
	var err error
	if data, err = ioutil.ReadFile(c.RootCA); err != nil {
	return nil, fmt.Errorf("ldap: read ca file: %v", err)
	}
	}
	rootCAs := x509.NewCertPool()
	if !rootCAs.AppendCertsFromPEM(data) {
	return nil, fmt.Errorf("ldap: no certs found in ca file")
	}
	tlsConfig.RootCAs = rootCAs
	}

openshift:

dex/connector/openshift/openshift.go

Lines 81 to 84 in 6cdbb59

	if openshiftConnector.httpClient, err = newHTTPClient(c.InsecureCA, c.RootCA); err != nil {
	cancel()
	return nil, fmt.Errorf("failed to create HTTP client: %v", err)
	}

Thank you for your time!

[xtremerui]

Hi could I get some feedbacks on thie PR? Thx @sagikazarmark

[sagikazarmark]

Apologies for the delay on this one.

I had a couple notes, but looks OK overall.

[sagikazarmark]

Would it make sense to create a common function in an internal package? Haven't checked how this is used in different packages, but unless there are significant differences, it might make sense to reuse.

[xtremerui]

I have extract the func out to a package named httpclient. The test of it requires some test certs as you can see. The instruction for regenerate the test certs are in the readme. Test certs are set to expired in 10 years.

@sagikazarmark please let me know if you want to set up the test differently. Thank you!

[nabokihms]

@xtremerui Thanks for your work, and sorry for this PR being delayed for so long. My apologies.

I am ready to merge this. Could you please fix the conflicts?

[xtremerui]

@nabokihms thx its done.

[nabokihms]

LGTM