[clokep]

This is similar to #7102 / #7186, but for OpenID (added in #7256).

It also cleans up a little bit of code to make things consistent between the various SSO workflows.

CC @sandhose

[anoadragon453]

Looks pretty sensible, but I'm afraid I'm missing a lot of context around OpenID in order to review this, which makes up the majority of this PR. Ideally @sandhose could take a look at those bits?

[sandhose]

LGTM. Nothing really changed in the OIDC flow, just that the session cookie has one more key in it (and that part is covered enough by unit tests)

[clokep]

@sandhose Do you think the macaroon changes are reasonable? Sometimes having a particular key there and sometimes now. I was unsure if this is "valid", but it seems to pass verification OK still.

[sandhose]

@sandhose Do you think the macaroon changes are reasonable? Sometimes having a particular key there and sometimes now. I was unsure if this is "valid", but it seems to pass verification OK still.

Wasn't sure either but I tested locally and it works. Seems like caveat verification in macaroons means that each first party caveat in the token must satisfy at least one verifier. It does not mean that each verifier must be used.

[richvdh]

lgtm otherwise