Damans227 opened a new pull request, #13867: URL: https://github.com/apache/cloudstack/pull/13867
Fixes #13859. Fixes #13860. `oauth2.plugins.exclude` was only checked once, at Spring bean registration time, by `ExtensionRegistry`. A config change didn't take effect without a restart. Even a restart didn't reliably help. The exclude value may not be loaded from the DB yet when the registry beans initialize. The registry also has no concept of domain at all. This replaces that with a live check in `OAuth2AuthManagerImpl`. It runs on every login/verify attempt instead of once at boot. - `isProviderExcluded(providerName, domainId)` checks the global `oauth2.plugins.exclude` list first. If a domainId is given, it then checks a new domain-scoped override of the same key. - `oauth2.plugins.exclude` is now `ConfigKey.Scope.Domain` (strict scope, no hierarchy walking). It can be set per domain in addition to globally. - Domain-level exclude is additive only. A domain can exclude further providers on top of the global list. It can never un-exclude something the global list already excludes. - `getUserOAuth2AuthenticationProvider()` gained a `(providerName, domainId)` overload. Both `OAuth2UserAuthenticator.authenticate()` and `OAuth2AuthManagerImpl.verifySecretCodeAndFetchEmail()` use it, since those are the two places that resolve a provider for an actual login attempt. The existing single-arg overload still exists. It delegates with `domainId = null`, global scope only. - `listUserOAuth2AuthenticationProviders()` now filters out excluded providers too. `listOauthProvider` stops reporting an excluded provider as available. Added test coverage for the union logic, the domain-scoped config key, and both call sites. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
