Skip to content

Commit 5e913db

Browse files
anandsyncsanandsyncs
authored
[OIDC] Update issuerURI validation logic (#186)
# Summary This pull request updates the validation logic for MongoDB versions in OIDC provider issuerURI validation and modifies corresponding test cases to reflect the changes. The main focus is on removing support for specific MongoDB 7.x versions in the duplicate issuer validation logic, ensuring compatibility with MongoDB 8.0+ only. ## Proof of Work New tests pass
1 parent 80ded51 commit 5e913db

10 files changed

+25
-58
lines changed

‎api/v1/mdb/mongodb_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1071,7 +1071,7 @@ type OIDCProviderConfig struct {
10711071

10721072
// Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
10731073
// Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
1074-
// For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
1074+
// For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
10751075
// For other MongoDB versions, the issuerURI itself must be unique.
10761076
// +kubebuilder:validation:Required
10771077
IssuerURI string `json:"issuerURI"`

‎api/v1/mdb/mongodb_validation.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package mdb
22

33
import (
44
"errors"
5+
"strconv"
56
"strings"
67

78
"k8s.io/apimachinery/pkg/runtime"
@@ -150,18 +151,18 @@ func oidcProviderConfigUniqueIssuerURIValidation(configs []OIDCProviderConfig) f
150151
return v1.ValidationSuccess()
151152
}
152153

153-
// Check if version supports duplicate issuers (7.0, 7.3, or 8.0+)
154+
// Check if version supports duplicate issuers (8.0+)
154155
versionParts := strings.Split(strings.TrimSuffix(d.Version, "-ent"), ".")
155-
supportsMultipleIssuers := false
156-
if len(versionParts) >= 2 {
156+
supportsMultipleIssuerURIs := false
157+
if len(versionParts) >= 1 {
157158
major := versionParts[0]
158-
minor := versionParts[1]
159-
if major == "8" || (major == "7" && (minor == "0" || minor == "3")) {
160-
supportsMultipleIssuers = true
159+
majorVersion, err := strconv.Atoi(major)
160+
if err == nil && majorVersion >= 8 {
161+
supportsMultipleIssuerURIs = true
161162
}
162163
}
163164

164-
if supportsMultipleIssuers {
165+
if supportsMultipleIssuerURIs {
165166
// Track issuer+audience combinations
166167
issuerAudienceCombos := make(map[string]string)
167168
for _, config := range configs {

‎api/v1/mdb/mongodb_validation_test.go‎

Lines changed: 7 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -506,8 +506,8 @@ func TestOIDCProviderConfigUniqueIssuerURIValidation(t *testing.T) {
506506
expectedResult v1.ValidationResult
507507
}{
508508
{
509-
name: "MongoDB 6.0 with duplicate issuer URIs - error",
510-
mongoVersion: "6.0.0",
509+
name: "MongoDB 7.0.11 with duplicate issuer URIs - error",
510+
mongoVersion: "7.0.11",
511511
configs: []OIDCProviderConfig{
512512
{
513513
ConfigurationName: "config1",
@@ -524,25 +524,8 @@ func TestOIDCProviderConfigUniqueIssuerURIValidation(t *testing.T) {
524524
"config1", "config2", "https://provider.com"),
525525
},
526526
{
527-
name: "MongoDB 7.0 with unique issuer+audience combinations",
528-
mongoVersion: "7.0.0",
529-
configs: []OIDCProviderConfig{
530-
{
531-
ConfigurationName: "config1",
532-
IssuerURI: "https://provider.com",
533-
Audience: "audience1",
534-
},
535-
{
536-
ConfigurationName: "config2",
537-
IssuerURI: "https://provider.com",
538-
Audience: "audience2",
539-
},
540-
},
541-
expectedResult: v1.ValidationSuccess(),
542-
},
543-
{
544-
name: "MongoDB 7.0 with duplicate issuer+audience combinations - warning",
545-
mongoVersion: "7.0.0",
527+
name: "MongoDB 8.0 with duplicate issuer+audience combinations - warning",
528+
mongoVersion: "8.0.0",
546529
configs: []OIDCProviderConfig{
547530
{
548531
ConfigurationName: "config1",
@@ -558,23 +541,6 @@ func TestOIDCProviderConfigUniqueIssuerURIValidation(t *testing.T) {
558541
expectedResult: v1.ValidationWarning("OIDC provider configs %q and %q have duplicate IssuerURI and Audience combination",
559542
"config1", "config2"),
560543
},
561-
{
562-
name: "MongoDB 7.3 with unique issuer+audience combinations",
563-
mongoVersion: "7.3.0",
564-
configs: []OIDCProviderConfig{
565-
{
566-
ConfigurationName: "config1",
567-
IssuerURI: "https://provider.com",
568-
Audience: "audience1",
569-
},
570-
{
571-
ConfigurationName: "config2",
572-
IssuerURI: "https://provider.com",
573-
Audience: "audience2",
574-
},
575-
},
576-
expectedResult: v1.ValidationSuccess(),
577-
},
578544
{
579545
name: "MongoDB 8.0 with unique issuer+audience combinations",
580546
mongoVersion: "8.0.0",
@@ -594,16 +560,16 @@ func TestOIDCProviderConfigUniqueIssuerURIValidation(t *testing.T) {
594560
},
595561
{
596562
name: "MongoDB enterprise version with -ent suffix",
597-
mongoVersion: "7.0.0-ent",
563+
mongoVersion: "7.0.11-ent",
598564
configs: []OIDCProviderConfig{
599565
{
600566
ConfigurationName: "config1",
601-
IssuerURI: "https://provider.com",
567+
IssuerURI: "https://provider-1.com",
602568
Audience: "audience1",
603569
},
604570
{
605571
ConfigurationName: "config2",
606-
IssuerURI: "https://provider.com",
572+
IssuerURI: "https://provider-2.com",
607573
Audience: "audience2",
608574
},
609575
},

‎config/crd/bases/mongodb.com_mongodb.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1573,7 +1573,7 @@ spec:
15731573
description: |-
15741574
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
15751575
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
1576-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
1576+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
15771577
For other MongoDB versions, the issuerURI itself must be unique.
15781578
type: string
15791579
requestedScopes:

‎config/crd/bases/mongodb.com_mongodbmulticluster.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -833,7 +833,7 @@ spec:
833833
description: |-
834834
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
835835
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
836-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
836+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
837837
For other MongoDB versions, the issuerURI itself must be unique.
838838
type: string
839839
requestedScopes:

‎config/crd/bases/mongodb.com_opsmanagers.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -895,7 +895,7 @@ spec:
895895
description: |-
896896
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
897897
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
898-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
898+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
899899
For other MongoDB versions, the issuerURI itself must be unique.
900900
type: string
901901
requestedScopes:

‎helm_chart/crds/mongodb.com_mongodb.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1573,7 +1573,7 @@ spec:
15731573
description: |-
15741574
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
15751575
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
1576-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
1576+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
15771577
For other MongoDB versions, the issuerURI itself must be unique.
15781578
type: string
15791579
requestedScopes:

‎helm_chart/crds/mongodb.com_mongodbmulticluster.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -833,7 +833,7 @@ spec:
833833
description: |-
834834
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
835835
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
836-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
836+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
837837
For other MongoDB versions, the issuerURI itself must be unique.
838838
type: string
839839
requestedScopes:

‎helm_chart/crds/mongodb.com_opsmanagers.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -895,7 +895,7 @@ spec:
895895
description: |-
896896
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
897897
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
898-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
898+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
899899
For other MongoDB versions, the issuerURI itself must be unique.
900900
type: string
901901
requestedScopes:

‎public/crds.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1573,7 +1573,7 @@ spec:
15731573
description: |-
15741574
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
15751575
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
1576-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
1576+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
15771577
For other MongoDB versions, the issuerURI itself must be unique.
15781578
type: string
15791579
requestedScopes:
@@ -4208,7 +4208,7 @@ spec:
42084208
description: |-
42094209
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
42104210
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
4211-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
4211+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
42124212
For other MongoDB versions, the issuerURI itself must be unique.
42134213
type: string
42144214
requestedScopes:
@@ -5854,7 +5854,7 @@ spec:
58545854
description: |-
58555855
Issuer value provided by your registered IdP application. Using this URI, MongoDB finds an OpenID Connect Provider
58565856
Configuration Document, which should be available in the /.wellknown/open-id-configuration endpoint.
5857-
For MongoDB 7.0, 7.3, and 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
5857+
For MongoDB 8.0+, the combination of issuerURI and audience must be unique across OIDC provider configurations.
58585858
For other MongoDB versions, the issuerURI itself must be unique.
58595859
type: string
58605860
requestedScopes:

0 commit comments

Comments
 (0)