providers/oauth2: support token revocation for public clients

[rissson]

Details

Closes #12053

From the RFC:

A malicious client may attempt to guess valid tokens on this endpoint
by making revocation requests against potential token strings.
According to this specification, a client's request must contain a
valid client_id, in the case of a public client, or valid client
credentials, in the case of a confidential client. The token being
revoked must also belong to the requesting client. If an attacker is
able to successfully guess a public client's client_id and one of
their tokens, or a private client's credentials and one of their
tokens, they could do much worse damage by using the token elsewhere
than by revoking it. If they chose to revoke the token, the
legitimate client will lose its authorization grant and will need to
prompt the user again. No further damage is done and the guessed
token is now worthless.

---

Checklist

• Local tests pass (ak test authentik/)
• The code has been formatted (make lint-fix)

If an API change has been made

• The API schema has been updated (make gen-build)

If changes to the frontend have been made

• The code has been formatted (make web)

If applicable

• The documentation has been updated
• The documentation has been formatted (make website)

[netlify]

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	5324330
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/6788f8ee010c280008491481

[netlify]

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	5324330
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/6788f8ee60988b0008e9412d

[rissson]

We may want to further split authenticate_provider to avoid parsing the request multiple times.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.76%. Comparing base (91ef8c2) to head (5324330).
Report is 5 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12704      +/-   ##
==========================================
- Coverage   92.77%   92.76%   -0.01%     
==========================================
  Files         769      769              
  Lines       38886    38898      +12     
==========================================
+ Hits        36075    36083       +8     
- Misses       2811     2815       +4     

Flag	Coverage Δ
e2e	48.58% <35.29%> (-0.06%)	⬇️
integration	24.62% <0.00%> (-0.01%)	⬇️
unit	90.39% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-5324330527139d0ac9b80168f54e8e9efc77d15b
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-5324330527139d0ac9b80168f54e8e9efc77d15b-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-5324330527139d0ac9b80168f54e8e9efc77d15b

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-5324330527139d0ac9b80168f54e8e9efc77d15b-arm64

Afterwards, run the upgrade commands from the latest release notes.