CRASM-2906 Replace Cognito with custom SP SAML auth endpoints

[nickviola]

🗣 Description

Replace Cognito with custom SAML auth service provider logic to authenticate users and change primary linking user. attribute to OktaID instead of email address. See CRASM Ticket for detailed documentation for new endpoints and process breakdown.

Certificate and Metadata URL ENV vars for encrypted deployments will be added via new Django S3 logic process (CRASM-2599)

New SAML endpoints (See CRASM Ticket for detailed documentation):

1. GET /saml/metadata
2. GET /saml/login
3. POST /saml/acs
4. GET /saml/logout

New auth flowchart:

💭 Motivation and context

This removes the need for additional third party user pool configuration/management and decreases failure point surface for authentication. This will allow us to remove the third party Cognito dependency and keep authentication flow complletely in the backend with direct SAML authentication with Okta. This also allows us to control the user upsert process and primary linking keys (OktaID vs NameID/Email).

🧪 Testing

Authentication Flow from a UI perspective should not change, Locally, you will need to make sure you have the OKTA_METADATA_URL added to your local env. This URL will be shared with the team for testing.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.

[cduhn17]

See comments

[nickviola]

Known Frontend CI failures that are being addressed in other tickets:

Linter issues: https://maestro.dhs.gov/jira/browse/CRASM-3437
Logger syntax issue: https://maestro.dhs.gov/jira/browse/CRASM-3384
Regression Testing: https://maestro.dhs.gov/jira/browse/CRASM-3434

[cduhn17]

I think there is already a basicConfig in settings.py. In practice, one basicConfig is desirable in Django, if you have more than one, can cause unexpected results.

[cduhn17]

Validate the URL before passing it into parse_remote. Wrap parse_remote in a try/except and log a clear error, then raise a controlled RuntimeError with a generic message, not the full stack trace or URL.