OCM-7110 | Fix GitHub IDP validation

Switch from URI validation to the DNS1123 validation. The openshift does not accept the URI format of domains. So when user specifies some address with prefix https:// it will fail. Signed-off-by: Martin Necas <[email protected]>
openshift-online · Apr 9, 2024 · 659b24d · 659b24d
1 parent 0570cbd
commit 659b24d
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 3 deletions.
diff --git a/cmd/ocm/create/idp/github.go b/cmd/ocm/create/idp/github.go
@@ -16,15 +16,25 @@ package idp
 import (
 	"errors"
 	"fmt"
+	"k8s.io/apimachinery/pkg/util/validation"
 	"net/url"
 	"strings"
 
 	c "github.com/openshift-online/ocm-cli/pkg/cluster"
 	cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
+	netutils "k8s.io/utils/net"
 
 	"github.com/AlecAivazis/survey/v2"
 )
 
+// isValidHostname is same validation as in the Open Shift GitHub IDP CRD
+// https://github.com/openshift/kubernetes/blob/91607f5d750ba4002f87d34a12ae1cfd45b45b81/openshift-kube-apiserver/admission/customresourcevalidation/oauth/helpers.go#L13
+//
+//nolint:lll
+func isValidHostname(hostname string) bool {
+	return len(validation.IsDNS1123Subdomain(hostname)) == 0 || netutils.ParseIPSloppy(hostname) != nil
+}
+
 func buildGithubIdp(cluster *cmv1.Cluster, idpName string) (idpBuilder cmv1.IdentityProviderBuilder, err error) {
 	clientID := args.clientID
 	clientSecret := args.clientSecret
@@ -115,9 +125,16 @@ func buildGithubIdp(cluster *cmv1.Cluster, idpName string) (idpBuilder cmv1.Iden
 		ClientSecret(clientSecret)
 
 	if args.githubHostname != "" {
-		_, err = url.ParseRequestURI(args.githubHostname)
-		if err != nil {
-			return idpBuilder, fmt.Errorf("Expected a valid Hostname: %v", err)
+		if !isValidHostname(args.githubHostname) {
+			return idpBuilder, fmt.Errorf(fmt.Sprintf("'%s' hostname must be a valid DNS subdomain or IP address",
+				args.githubHostname))
+		}
+		// Allow only non GitHub domains
+		// https://github.com/openshift/kubernetes/blob/258f1d5fb6491ba65fd8201c827e179432430627/openshift-kube-apiserver/admission/customresourcevalidation/oauth/validate_github.go#L49
+		//nolint:lll
+		if args.githubHostname == "github.com" || strings.HasSuffix(args.githubHostname, ".github.com") {
+			return idpBuilder, fmt.Errorf(fmt.Sprintf("'%s' hostname cannot be equal to [*.]github.com",
+				args.githubHostname))
 		}
 		// Set the hostname, if any
 		githubIDP = githubIDP.Hostname(args.githubHostname)

diff --git a/go.mod b/go.mod
@@ -22,6 +22,7 @@ require (
 	golang.org/x/text v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/apimachinery v0.27.3
+	k8s.io/utils v0.0.0-20230209194617-a36077c30491
 )
 
 require (

diff --git a/go.sum b/go.sum
@@ -747,6 +747,8 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM=
 k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E=
+k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
+k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=