OIDC support for a dynamic redirect_url based on proxy/config

[jdconti]

What

What would you like Teleport to do differently? The current OIDC implementation allows a single redirect_url for the entire cluster (e.g. proxy.example.com). This works fine when all proxies are behind a single load balancer or you're using something like DNS views so all initiating sessions and OIDC callbacks hit the same proxy.example.com. However, this breaks down when you have multiple proxies which are NOT behind a single load balancer / FQDN (for latency or other reasons). It would be helpful to have either the redirect_url automatically populated by public_addr or hostname of the proxy which initiated the OIDC session OR have a redirect_url definable per-proxy in the proxy section of each proxies config.

How

How would you implement this? This can be addressed with a default behavior of using the initiating proxy as the redirect_url and/or override the redirect_url per-proxy in the config.

Why

Why do you need this? This change routes the OIDC callback to the appropriate proxy and removes any reliance on external dependencies like DNS views, OIDC routing apps, 301 redirects, etc...

Workaround

If a workaround exists, please include it:

The current workaround uses nginx with the geoip module and a 301 based on location. However, we'd like to avoid supporting this external dependency long-term. Also, the current implementation of this workaround breaks down when you have users which want to use a proxy outside their region (since the callback would be 301'd to their regional proxy and result in a CSRF token mismatch)