16171: Warn about OIDC issuer URL spelling sensitivity.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>

diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml
index d1c47f4a28d65c205eb665c03528c478bf2e18bc..be0123574f02139b1bc1f9b920745c0660a3f6c6 100644 (file)
--- a/lib/config/config.default.yml
+++ b/lib/config/config.default.yml
@@ -556,6 +556,18 @@ Clusters:
         Enable: false
 
         # Issuer URL, e.g., "https://login.example.com".
+        #
+        # This must be exactly equal to the URL returned by the issuer
+        # itself in its config response ("isser" key). If the
+        # configured value is "https://example" and the provider
+        # returns "https://example:443" then login will fail, even
+        # though those URLs are equivalent (RFC3986).
+        #
+        # If the configured URL's path component is just "/" then it
+        # is stripped. Therefore, an issuer advertising itself as
+        # "https://example/" cannot be used -- but "https://example",
+        # "https://example/foo", and "https://example/foo/" are
+        # supported.
         Issuer: ""
 
         # Your client ID and client secret (supplied by the provider).

diff --git a/lib/config/generated_config.go b/lib/config/generated_config.go
index 0dda58db085624feb503db55d7536be07701de6f..49d86c77f2b010d15b11999d06a54da105c1da52 100644 (file)
--- a/lib/config/generated_config.go
+++ b/lib/config/generated_config.go
@@ -562,6 +562,18 @@ Clusters:
         Enable: false
 
         # Issuer URL, e.g., "https://login.example.com".
+        #
+        # This must be exactly equal to the URL returned by the issuer
+        # itself in its config response ("isser" key). If the
+        # configured value is "https://example" and the provider
+        # returns "https://example:443" then login will fail, even
+        # though those URLs are equivalent (RFC3986).
+        #
+        # If the configured URL's path component is just "/" then it
+        # is stripped. Therefore, an issuer advertising itself as
+        # "https://example/" cannot be used -- but "https://example",
+        # "https://example/foo", and "https://example/foo/" are
+        # supported.
         Issuer: ""
 
         # Your client ID and client secret (supplied by the provider).