Refresh OAuth2 tokens automatically

[eisenmann-b1]

This adds token refreshing functionality.

List of changes:

• Tokens are saved as user attrs in the cache.
  Getting the tokens from cache currently requires the use of 3rd party tools, like ldbsearch.
  If support for the systemd-userdb varlink interface is added In the future, the tokens could be exposed there as privileged user attributes.
• Add flag --refresh-access-token to oidc_child:
  If set, a refresh token is read from standard input, that is then used to acquire a new set of tokens (access, id, refresh) via refresh_token grant type.
• Add option idp_auto_refresh:
  If set to true (default false), tokens are automatically refreshed after reaching half their lifetime.

A refresh is scheduled after successful authentication.
The event is stored in a hash table with user UUID as key, so there will be at most one refresh scheduled per user.

For now, refreshes are not scheduled from cache, i.e. restarting sssd will stop refreshes.

[gemini-code-assist]

Code Review

This pull request introduces OAuth2 token refreshing, both manually via a new oidc_child command and automatically through a new configuration option. The changes span configuration, database schema, the oidc_child tool, and the idp provider. While the overall implementation is solid, I've identified several issues, including copy-paste errors in logging that could be misleading, a critical bug in parsing input that may cause token refresh to fail, and a minor bug where a function's return value is not checked.

[spoore1]

Hi @eisenmann-b1 ,

While @sumit-bose and @alexey-tikhonov are reviewing the code, I'd like to get an idea of how urgent this PR is. Can you let us know when you are looking to get this merged? And for what target distro you'd like to be able to start using it?

This will help us plan for testing this PR as well as potentially expanding existing tests to cover this.

Thanks,
Scott

[eisenmann-b1]

Hi @spoore1,

Can you let us know when you are looking to get this merged?

Well, I just hope it makes it into 2.13 :)

And for what target distro you'd like to be able to start using it?

I am currently using Ubuntu 24.04 for testing it, but I don't think anything in here is platform-specific.