Alternative token exchange

[floeschau]

With this change, an alternative way of token exchange (Cross-Domain Federation), alongside the existing Internal-to-External exchange is enabled. This can be extended into Trusted Token Delegation (by adding additional claims to the access token).

This is needed to have the Dispatcher run in different environments (e.g. for testing and reference) and with a different IDP configurations where the IDP authorising the use of the execution platform is not configured within the central IDP (e.g. APEx).

It requires additional settings in the BACKENDS configuration (all of which are optional so as to guarantee backward compatibility), e.g. in the case of the Geohazards Exploitation Platform (GEP):

{
    ...
    "https://processing.geohazards-tep.eu": {
        "auth_method": "USER_CREDENTIALS",
        "token_provider": "gep",
        "token_url": "https://iam.terradue.com/realms/master/protocol/openid-connect/token",
        "client_id": "apex-test-token",
        "client_secret": "...",
        "subject_issuer": "iam-dev-apex",
        "audience": "processing-gep-apex"
    }
}

The presence of token_url in the backend configuration triggers the alternative token exchange. Otherwise the existing routine is used.