enable custom Azure endpoints for Government Cloud Services customers

[jlane67]

Overview

Stops hard-coding Azure endpoints as they are not universally accurate.

What this PR does / why we need it

Resolves #2457. Pure OIDC mode is unable to retrieve group membership data from Azure AD, meaning RBAC is impossible.

Special notes for your reviewer

Does this PR introduce a user-facing change?

yes

This change makes the Azure endpoints configurable.  For most users, the default 
https://login.microsoftonline.com/ and https://graph.microsoft.com/ values 
will remain the correct choice, but this allows users of Azure in special 
regions, such as Government Cloud Services for export-controlled workloads, 
to use the Microsoft connector to get group membership.

[sagikazarmark]

@jlane67 thanks for the contribution!

On the surface, this seems to be a breaking change as the default values for those URLs are empty strings.

Do you know if the underlying library falls back to the right default values in this case? Can you also point to the code in the SDK?

Last, but not least: can you please update the documentation? https://github.com/dexidp/website/blob/main/content/docs/connectors/microsoft.md

[jlane67]

Hi, thank you for pointing that out. I have added another commit adding a fallback to the default values. I'm not super experienced at Go, but this is just something that came up in the course of deploying Dex. If the logical flow looks good I can add a PR to fix the documentation.

[jlane67]

I have confirmed in a deployment on our infrastructure that the changes in this PR allow full authentication with Azure Government Cloud Services when using the .us endpoints.

[sleterrier]

@sagikazarmark: anything I could do to help get this PR merged? We are also interested in using Dex against non standard endpoints.

[dsetlock]

@sagikazarmark wanting to pick this thread back up. Trying to deploy Dex into Azure Government I hit this same blocker and came here to investigate but it seems a PR has been make the Azure endpoints more flexible for over a year.

[sagikazarmark]

I'm looking at the code and....I'm a little bit confused. I don't think this code even compiles.