feat: add validate oidc token call to zaas client

[pablocarle]

Description

Add method in ZaasClient to use /oidc/validate endpoint in API Mediation Layer.

This implementation targets v3 Zowe, currently supporting only a boolean response (token is a valid OIDC token issued by the target API Mediation Layer's configured OIDC provider)

Type of change

• feat: New feature (non-breaking change which adds functionality)

Checklist:

• My code follows the style guidelines of this project
• PR title conforms to commit message guideline ## Commit Message Structure Guideline
• I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• The java tests in the area I was working on leverage @nested annotations
• Any dependent changes have been merged and published in downstream modules

[achmelo]

it would be great to have some integration test

[pablocarle]

it would be great to have some integration test

Thanks, added

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dkelosky]

Perhaps this is non-standard for Java API doc, but should it be explicitly stated that "successful validation" means that ZaasOidcValidationResults.isValid() is true?

[pablocarle]

It can be added to the javadoc description, no problem with that

[dkelosky]

What does this mean exactly? If a token is mapped to a mainframe user, isValid() will be false? Does a service still have access to the OIDC token if the user is mapped?

[pablocarle]

What I wanted to clarify with this is the fact that currently the API ML will say:

• isValid(): true if the OIDC token queried by the Zaas Client was issued by the OIDC provider that is configured in the queried API ML instance. The current implementation in the server side doesn't check if the token is mapped.
• isValid(): false if the OIDC token is not generated by the OIDC provider or if API ML is not enabled to handle OIDC tokens.

Regarding whether a service has access to the OIDC token if the user is mapped or not, I think it's unrelated to this change, as this simply enables services using the ZaasClient to query. So it will depend on the service's setup.

[dkelosky]

Got it thanks.

I think it's unrelated to this change, as this simply enables services using the ZaasClient to query.

It is unrelated. I was merely curious.