Feature/tim ad exchange

[NayanthaRC]

This pull request implements a major refactor of Azure AD OAuth2 authentication for the Global Classifier project, consolidating the Azure AD logic into the TIM service and removing the separate azure-ad-service. Key improvements include new endpoints for Azure AD OAuth2 flows, streamlined JWT generation, and enhanced environment/configuration management.

Azure AD Authentication Refactor & Integration:

• Introduced a new AzureAdController in TIM that handles the full Azure AD OAuth2 flow: authorization URL generation, token exchange, and JWT creation, including saving tokens and allowlisting sessions. This replaces the previous external azure-ad-service.
• Added new domain classes to TIM (AzureAuthorizationResponse, AzureCallbackRequest) and migrated related code from the old service. [1] [2]
• Updated the security configuration in TIM to allow unauthenticated access to /azure-ad/** endpoints.

Workflow & API Changes:

• Refactored the Ruuter workflow for Azure AD OAuth2 (GET/oauth2/authorization-azure.yml and GET/oauth2/callback-azure.yml) to interact with the new endpoints in TIM instead of the old service, and simplified the callback logic to rely on the new JWT generation endpoint. [1] [2] [3] [4] [5]

Configuration and Environment Management:

• Updated .env.example with new Azure AD and role mapping variables, and removed sensitive values from .env (which is now gitignored). [1] [2] [3]
• Updated docker-compose.yml to inject new Azure AD environment variables into the tim service and removed the azure-ad-service container. [1] [2]

Security and Utility Improvements:

• Improved redirect URL whitelist logic in CustomSessionAttributeSecurityFilter to handle comma-separated patterns and prevent empty/undefined lists. [1] [2]

---

Most important changes:

Azure AD Authentication Flow Refactor

• Added a new AzureAdController in TIM to handle Azure AD OAuth2 authorization, token exchange, and JWT generation, consolidating all related logic and removing the need for the separate azure-ad-service.
• Migrated and renamed supporting domain classes for Azure AD flows into TIM. [1] [2]

Workflow & API Adjustments

• Updated Ruuter DSL workflows to use the new TIM endpoints for Azure AD authentication and simplified the callback logic for JWT issuance. [1] [2] [3] [4] [5]

Configuration and Environment

• Enhanced .env.example with Azure AD and role mapping settings, removed secrets from .env, and ensured .env is gitignored. [1] [2] [3]
• Updated docker-compose.yml to remove the azure-ad-service and pass new Azure AD variables to the tim container. [1] [2]

Security Improvements

• Improved redirect URL whitelist parsing and validation in CustomSessionAttributeSecurityFilter. [1] [2]

Access Control

• Allowed unauthenticated access to the new /azure-ad/** endpoints in the TIM security configuration.