OCPBUGS-114898: validate OIDC issuer URL and set Degraded when invalid

pkg/console/controllers/oidcsetup/oidcsetup.go

@@ -2,7 +2,15 @@ package oidcsetup
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
 	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"strings"
 	"time"
 
 	configv1client "github.com/openshift/client-go/config/clientset/versioned/typed/config/v1"
@@ -206,12 +214,17 @@ func (c *oidcSetupController) syncAuthTypeOIDC(ctx context.Context, authnConfig
 		return err
 	}
 
+	var caBundle []byte
 	if caCMName := oidcProvider.Issuer.CertificateAuthority.Name; len(caCMName) > 0 {
 		caCM, err := c.configConfigMapLister.ConfigMaps(api.OpenShiftConfigNamespace).Get(caCMName)
 		if err != nil {
 			return fmt.Errorf("failed to get the CA configMap %q configured for the OIDC provider %q: %w", caCMName, oidcProvider.Name, err)
 		}
 
+		if data, ok := caCM.Data["ca-bundle.crt"]; ok {
+			caBundle = []byte(data)
+		}
+
 		_, _, err = resourceapply.SyncPartialConfigMap(ctx,
 			c.configMapClient,
 			recorder,
@@ -224,6 +237,11 @@ func (c *oidcSetupController) syncAuthTypeOIDC(ctx context.Context, authnConfig
 		}
 	}
 
+	if err := validateOIDCIssuer(ctx, oidcProvider.Issuer.URL, oidcProvider.Issuer.DiscoveryURL, caBundle); err != nil {
+		c.authStatusHandler.DegradedNotAvailable("OIDCIssuerURLInvalid", err.Error())
+		return err
+	}
+
 	if valid, msg, err := c.checkClientConfigStatus(authnConfig, clientSecret); err != nil {
 		c.authStatusHandler.Degraded("DeploymentOIDCConfig", err.Error())
 		return err
@@ -298,3 +316,115 @@ func (c *oidcSetupController) handleManaged() (bool, error) {
 		return false, fmt.Errorf("console is in an unknown state: %v", managementState)
 	}
 }
+
+// validateOIDCIssuer checks that the OIDC issuer URL is well-formed and that
+// the OIDC discovery endpoint is reachable. It returns an error describing the
+// problem when the URL is invalid or the discovery probe fails.
+func validateOIDCIssuer(ctx context.Context, issuerURL string, discoveryURLOverride string, caBundle []byte) error {
+	if len(issuerURL) == 0 {
+		return fmt.Errorf("issuer URL is empty")
+	}
+
+	parsed, err := url.Parse(issuerURL)
+	if err != nil {
+		return fmt.Errorf("issuer URL is malformed: %w", err)
+	}
+
+	if !strings.EqualFold(parsed.Scheme, "https") {
+		return fmt.Errorf("issuer URL must use HTTPS scheme, got %q", parsed.Scheme)
+	}
+
+	if len(parsed.Host) == 0 {
+		return fmt.Errorf("issuer URL has no host")
+	}
+
+	if parsed.RawQuery != "" {
+		return fmt.Errorf("issuer URL must not contain a query component")
+	}
+
+	if parsed.Fragment != "" {
+		return fmt.Errorf("issuer URL must not contain a fragment component")
+	}
+
+	// Probe the OIDC discovery endpoint. When the API specifies an explicit
+	// discoveryURL (ExternalOIDCWithUpstreamParity feature gate), use it
+	// instead of deriving the standard path from the issuer URL.
+	discoveryURL := discoveryURLOverride
+	if len(discoveryURL) == 0 {
+		discoveryURL = strings.TrimRight(issuerURL, "/") + "/.well-known/openid-configuration"
+	}
+
+	tlsConfig := &tls.Config{
+		MinVersion: tls.VersionTLS12,
+	}
+	if len(caBundle) > 0 {
+		pool := x509.NewCertPool()
+		if !pool.AppendCertsFromPEM(caBundle) {
+			return fmt.Errorf("failed to parse CA bundle for OIDC issuer")
+		}
+		tlsConfig.RootCAs = pool
+	}
+
+	transport := &http.Transport{
+		TLSClientConfig: tlsConfig,
+		Proxy:           http.ProxyFromEnvironment,
+	}
+	client := &http.Client{
+		Transport: transport,
+		Timeout:   10 * time.Second,
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, discoveryURL, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create OIDC discovery request: %w", err)
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("OIDC issuer URL %q is not reachable: %w", issuerURL, err)
+	}
+	defer func() {
+		if closeErr := resp.Body.Close(); closeErr != nil {
+			klog.V(4).Infof("failed to close OIDC discovery response body: %v", closeErr)
+		}
+	}()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("OIDC discovery endpoint returned HTTP %d for issuer %q", resp.StatusCode, issuerURL)
+	}
+
+	// Per OpenID Connect Discovery 1.0 §4.2, the response MUST use
+	// application/json. Require the header so we fail fast on
+	// misconfigured providers instead of falling through to JSON parsing.
+	contentType := resp.Header.Get("Content-Type")
+	if contentType == "" {
+		return fmt.Errorf("OIDC discovery endpoint returned no Content-Type header for issuer %q", issuerURL)
+	}
+	mediaType, _, err := mime.ParseMediaType(contentType)
+	if err != nil || mediaType != "application/json" {
+		return fmt.Errorf("OIDC discovery endpoint returned non-JSON content type %q for issuer %q", contentType, issuerURL)
+	}
+
+	// Decode and validate the discovery document
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20)) // 1 MiB limit
+	if err != nil {
+		return fmt.Errorf("failed to read OIDC discovery response: %w", err)
+	}
+
+	var discovery struct {
+		Issuer string `json:"issuer"`
+	}
+	if err := json.Unmarshal(body, &discovery); err != nil {
+		return fmt.Errorf("OIDC discovery response is not valid JSON: %w", err)
+	}
+
+	// Per OpenID Connect Discovery 1.0, the issuer value in the discovery
+	// document MUST exactly match the issuer URL used to retrieve it.
+	normalizedIssuer := strings.TrimRight(issuerURL, "/")
+	normalizedDiscovery := strings.TrimRight(discovery.Issuer, "/")
+	if normalizedDiscovery != normalizedIssuer {
+		return fmt.Errorf("OIDC discovery issuer %q does not match configured issuer %q", discovery.Issuer, issuerURL)
+	}
+
+	return nil
+}