WebTop: sign in with ns8-idp #8266

WebTop users must type their password in the WebTop login page, even if they already signed in to other cluster applications. With single sign-on they open WebTop without typing the password again, and WebTop reads the mailbox with the sign-in token.

Proposed solution

• In the WebTop application settings, select an OIDC provider among those available in the cluster. The option is hidden if no provider is installed.
• The administrator can decide not to use single sign-on, even if a provider is installed: the default is no provider, and users keep signing in with their password.
• Register the WebTop client with register-client, adding the client of the bound Mail application to the token audience.
• Sign in users with OIDC, matching existing WebTop users by user name.
• Access IMAP and SMTP with the user's token (XOAUTH2 / OAUTHBEARER) instead of the password.
• Keep the configuration up to date on service-oidc-changed events, and remove it when the provider is removed.
• If the realm accepts only federated logins, send users straight to the provider, and document the emergency login path, including the WebTop administrator.

Alternative solutions

• OIDC login with mailbox access through a master user: rejected, it grants WebTop access to every mailbox.

Additional context

Depends on #8264. Check how the token is refreshed during long WebTop sessions, and how CalDAV/CardDAV and ActiveSync (which keep using passwords) are affected.

See also

• Parent: Single sign-on for applications with ns8-idp #8258
• https://github.com/NethServer/ns8-webtop