Group SAML - Check SSO status on API activity and direct user to SSO

Problem to solve

While we're enforcing SSO, we should similarly enforce SSO outside of the GitLab UI. For the purposes of security, this gives enterprises a greater degree of control over protected resources.

Proposal

We should perform the same check on API activity that we do in the UI:

• When a user attempts an API action in a group that's enforcing SSO:
  • If the represented user does not meet the SSO login threshold, present them with an error: "Cannot find valid SSO session. Please login via your group's SSO at #{group_saml_url}"
• This change should be a configuration option at the group level.
• Credentials that are not tied to human users should not have an SSO check enforces (Project Access token, deploy keys, etc).

Iteration plan

1. Introduce a new configuration option at the group level. This option should be disabled by default for existing and new SAML setups:

2. If user attempts an API action in a group that's enforcing SSO, and the represented user does not meet the SSO login threshold, present them with an error: ``"Cannot find valid SSO session. Please login via your group's SSO at #{group_saml_url}"

3. Credentials that are not tied to human users should not have an SSO check enforces (Project Access token, deploy keys, etc).

Availability & Testing

What risks does this change pose to our availability?

A potential risk to account access: Users/bots may lose access incase we default enable the enforce SSO for API activity for all existing accounts that use PAT for automated access.

What additional test coverage or changes to tests will be needed?

• Ensure the feature is off by default
• Ensure Project access tokens (for bot users) are exempt from this enforcement.
• Ensure Personal access tokens are NOT exempt from this enforcement.

Also, we should be adding end-to-end tests coverage for this feature.