Damans227 opened a new pull request, #13866: URL: https://github.com/apache/cloudstack/pull/13866
Fixes #13862. `oauth2.plugins` (default `google,github`, described as "List of OAuth plugins") was declared as a `ConfigKey` but never read anywhere. Actual provider availability was determined entirely by which Spring beans exist plus `oauth2.plugins.exclude`, so changing `oauth2.plugins` was a complete no-op, an admin could set it to `github,keycloak` and `google` would remain fully functional. This wires it up as an allow-list: a provider must be named in `oauth2.plugins` to be usable. - `OAuth2AuthManagerImpl.getUserOAuth2AuthenticationProvider()` now rejects any provider not in the configured list (covers both the `oauthlogin` and `verifyOAuthCodeAndGetUser` paths, since both resolve the provider through this method). - `OAuth2AuthManagerImpl.listUserOAuth2AuthenticationProviders()` filters the same way, so `listOauthProvider` no longer reports a disallowed provider as enabled. - Match is case-insensitive, consistent with how provider names are looked up elsewhere in this class. Added test coverage for the allow-list check itself and for both call sites. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
