One login auth

[CatalinVoineag]

Context

We want to move our candidates to use one login when sigin up/in to our
service.

This PR adds the basic implementation for users to log in or create
a candidate account in apply using one login. It also has a bypass for localhost and review apps.

Next steps:

• Block requests to magic link implementation if one login feature flag is active
• Add one login link in govuk header for users to manage their one login account
• Implement the account recovery system:w

Changes proposed in this pull request

get '/auth/onelogin/callback' -- one login sends the email and token
get '/auth/one-login-developer/callback' -- bypass callback for review and local env
get '/auth/onelogin/sign-out' -- our sign-out route, here we send a request to onelogin to log the user out
get '/auth/onelogin/sign-out-complete' - one login comes back to us to this route when signing the user out
get '/auth/failure' -- one login will send a request to this route if there's a 500 error on their end

Changes to the smoke test e4fbcba

Guidance to review

For bypass

Go on review app and log in as a candidate
Put anything in the uid column, a new candidate with one login will be created
Email would be [email protected]
Log out
Use the same uid, you should be logged in as the same candidate now.

For normal flow

Go on an https://qa.apply-for-teacher-training.service.gov.uk/candidate/account
Click continue
Input your one login account, you might already have one, if not create one.
You should be redirected back to qa

kazam_proo7lg1.movie.mp4

Things to check

• If the code removes any existing feature flags, a data migration has also been added to delete the entry from the database
• This code does not rely on migrations in the same Pull Request
• If this code includes a migration adding or changing columns, it also backfills existing records for consistency
• If this code adds a column to the DB, decide whether it needs to be in analytics yml file or analytics blocklist
• If this code adds a column that may include PII, the sanitise.sql script and 0025-protecting-personal-data-in-production-dump.md ADR have been updated.
• API release notes have been updated if necessary
• If it adds a significant user-facing change, is it documented in the CHANGELOG?
• Required environment variables have been updated added to the Azure KeyVault
• Inform data insights team due to database changes
• Make sure all information from the Trello card is in here
• Rebased main
• Cleaned commit history
• Tested by running locally
• Add PR link to Trello card

[dcyoung-dev]

Nice one - I've highlighted a few name changes but other than that this is good to go 👌

[sentry-io]

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

• ‼️ One login failure with ActionController::InvalidAuthenticityToken for one_login_id_token: OneLoginController#sign_out_complete View Issue

_{Did you find this useful? React with a 👍 or 👎}