Bug 2021497

Feature: Replace oVirt default (internal) Single-Sign-On implementation (SSO)[1] with bundled Keycloak[2] (OpenID protocol). Reason: Our existing (internal) SSO supports only a limited number of authentication providers. It is an in-house implementation of OAuth protocol that required significant amount of effort on maintenance. The Keycloak solution enables oVirt user to use additional authentication providers in addition to JDBC or LDAP. These includes integration with 3rd party SSO providers ie. GitHub, Google, Facebook as well as with custom ones. Another benefit is ability to easily configure multi step authentication to increase overall security level of the oVirt installation. Result: oVirt administrators will be able to fully use Keycloak capabilities in terms of setting up authentication/SSO mechanism and multiple user bases. Please note that default ovirt administrator user name has been changed from 'admin' to 'admin@ovirt' (Administrator Panel, VM Portal) and from 'admin@internal' to 'admin@ovirt@internalsso' (REST API). Covered deployment scenarios are documented here[3]. With this RFE implementation it is now possible to login to Monitoring Portal(Grafana) using 'oVirt Single Sing On'. Grafana initial admin user ('admin') is matched by email to default oVirt Administrator ('admin@ovirt') [1]https://ovirt.org/documentation/administration_guide/index.html#chap-Users_and_Roles [2]https://www.keycloak.org [3]https://github.com/oVirt/ovirt-engine-keycloak/blob/master/keycloak_usage.md