Use external Kong-Role and add end-to-end IAM integration tests

[vtavakkoli]

Summary

Replace the duplicated local Kong/OIDC implementation with the separately maintained vtavakkoli/Kong-Role repository and add a real Keycloak-to-Kong-to-LOB integration test.

Gateway changes

• Build Kong directly from pinned Kong-Role commit f1fdd2e6e9c4b8b58fd0b3b76e67589d18c1abff.
• Remove the local kong/Dockerfile, local declarative v1 configuration, and copied kong/oidc Lua modules.
• Use gateway/kong.yml with Kong-Role 2.0.0 JWT mode.
• Validate JWT signatures with Keycloak discovery/JWKS and the expected external issuer.
• Use preferred_username as the configured principal because this Keycloak 26.2 direct-grant access token omits sub.
• Extract every realm_access.roles value as an authenticated Kong group.
• Use route ACLs for lob1-user, lob2-user, and lob3-user without synthetic Kong consumers.
• Enable dynamic Keycloak backchannel URLs so discovery and JWKS retrieval stay inside the Compose network.

Integration test

The integration-test Compose profile:

1. starts Keycloak, the external Kong-Role image, and all three LOB services;
2. creates a temporary direct-grant Keycloak client through the Admin REST API;
3. obtains real JWTs for Alice, Bob, and Charlie;
4. validates issuer, configured principal, and role claims;
5. calls every protected route through Kong;
6. verifies missing/invalid token 401, denied role 403, and allowed route 200 behavior.

Validated matrix:

• Alice: LOB1 200; LOB2/LOB3 403
• Bob: LOB1/LOB2 200; LOB3 403
• Charlie: LOB1/LOB2/LOB3 200

CI result

The complete GitHub Actions Compose integration passed. It built Kong from the remote repository, verified real RS256 Keycloak tokens, propagated multiple roles, enforced every ACL decision, reached the correct LOB services, and exited with code 0.

Upstream fix discovered by the integration

The test exposed that the previous Kong-Role container depended on unstable LuaRocks resolution. The companion Kong-Role PR vendors pinned lua-resty-openidc, lua-resty-jwt, and lua-resty-hmac runtime files so the image builds reproducibly.

Local command

docker compose --profile integration-test up \
  --build \
  --abort-on-container-exit \
  --exit-code-from integration-test \
  integration-test

The PR remains draft for review even though the full integration test now passes.