CORS-4423: update GCP auth functions & validations

pkg/asset/installconfig/gcp/services.go

@@ -2,6 +2,7 @@ package gcp
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 
 	"cloud.google.com/go/storage"
@@ -61,8 +62,8 @@ func CreateEndpointOption(endpointName string, service ServiceNameGCP) option.Cl
 
 // CredentialOptions returns the client options for authenticating with GCP,
 // including universe domain support for Google Cloud Dedicated.
-// When credential JSON is available, it is passed via WithCredentialsJSON so
-// the client library can use self-signed JWTs for non-default universe
+// When credential JSON is available, it is passed via WithAuthCredentialsJSON
+// so the client library can use self-signed JWTs for non-default universe
 // domains (where the OAuth2 token endpoint is unavailable). Falls back to
 // WithCredentials for metadata-based credentials that have no JSON.
 func CredentialOptions(ssn *Session) ([]option.ClientOption, error) {
@@ -72,7 +73,16 @@ func CredentialOptions(ssn *Session) ([]option.ClientOption, error) {
 	}
 	var opts []option.ClientOption
 	if len(ssn.Credentials.JSON) > 0 {
-		opts = append(opts, option.WithCredentialsJSON(ssn.Credentials.JSON))
+		// WithAuthCredentialsJSON takes a credentials type argument to allow
+		// restricting which credential types are accepted from external sources.
+		// In this case, there are no restrictions so we simply pass the type through.
+		var f struct {
+			Type string `json:"type"`
+		}
+		if err := json.Unmarshal(ssn.Credentials.JSON, &f); err != nil {
+			return nil, fmt.Errorf("failed to parse credentials JSON: %w", err)
+		}
+		opts = append(opts, option.WithAuthCredentialsJSON(option.CredentialsType(f.Type), ssn.Credentials.JSON))
 	} else {
 		opts = append(opts, option.WithCredentials(ssn.Credentials))
 	}

pkg/asset/installconfig/gcp/session.go

@@ -2,7 +2,9 @@ package gcp
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -44,6 +46,12 @@ func GetSession(ctx context.Context) (*Session, error) {
 		return nil, errors.Wrap(err, "failed to load credentials")
 	}
 
+	if creds.JSON != nil {
+		if err := validateCredentialURLs(creds.JSON); err != nil {
+			return nil, err
+		}
+	}
+
 	return &Session{
 		Credentials: creds,
 		Path:        path,
@@ -182,7 +190,14 @@ type contentLoader struct {
 }
 
 func (f *contentLoader) Load(ctx context.Context) (*googleoauth.Credentials, error) {
-	return googleoauth.CredentialsFromJSON(ctx, []byte(f.content), compute.CloudPlatformScope)
+	jsonData := []byte(f.content)
+	var t struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(jsonData, &t); err != nil {
+		return nil, fmt.Errorf("failed to parse credentials JSON: %w", err)
+	}
+	return googleoauth.CredentialsFromJSONWithType(ctx, jsonData, googleoauth.CredentialsType(t.Type), compute.CloudPlatformScope)
 }
 
 func (f *contentLoader) String() string {
@@ -230,3 +245,67 @@ func (u *userLoader) Load(ctx context.Context) (*googleoauth.Credentials, error)
 func (u *userLoader) Content() string {
 	return defaultAuthFilePath
 }
+
+// validateCredentialURLs validates external_account (Workload Identity Federation)
+// credential URLs per Google's guidance that callers must validate these fields:
+// https://google.aip.dev/auth/4117
+// https://cloud.google.com/docs/authentication/client-libraries#external-credentials
+//
+// WIF with custom universe domains is not supported in the installer — all
+// Google endpoint URLs are restricted to googleapis.com.
+func validateCredentialURLs(credsJSON []byte) error {
+	var t struct {
+		Type string `json:"type"`
+	}
+	if err := json.Unmarshal(credsJSON, &t); err != nil {
+		return nil
+	}
+	if t.Type != "external_account" {
+		return nil
+	}
+
+	var creds struct {
+		TokenURL                       string `json:"token_url"`
+		ServiceAccountImpersonationURL string `json:"service_account_impersonation_url"`
+		UniverseDomain                 string `json:"universe_domain"`
+		CredentialSource               struct {
+			URL string `json:"url"`
+		} `json:"credential_source"`
+	}
+	if err := json.Unmarshal(credsJSON, &creds); err != nil {
+		return fmt.Errorf("failed to parse external account credentials: %v", err)
+	}
+
+	if creds.UniverseDomain != "" && creds.UniverseDomain != "googleapis.com" {
+		return fmt.Errorf("Workload Identity Federation (external_account) with custom universe domain %q is not supported. "+
+			"If you need this capability, please open an RFE with Red Hat or a GitHub issue at https://github.com/openshift/installer/issues", creds.UniverseDomain)
+	}
+
+	const expectedTokenURL = "https://sts.googleapis.com/v1/token"
+	const iamPrefix = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/"
+	const wifNote = "Workload Identity Federation (external_account) credentials are only supported with googleapis.com endpoints"
+
+	if creds.TokenURL != "" && creds.TokenURL != expectedTokenURL {
+		return fmt.Errorf("token_url %q must equal %s. %s", creds.TokenURL, expectedTokenURL, wifNote)
+	}
+	if creds.ServiceAccountImpersonationURL != "" && !strings.HasPrefix(creds.ServiceAccountImpersonationURL, iamPrefix) {
+		return fmt.Errorf("service_account_impersonation_url %q must begin with %s. %s", creds.ServiceAccountImpersonationURL, iamPrefix, wifNote)
+	}
+	if creds.CredentialSource.URL != "" {
+		if err := validateCredSourceURL(creds.CredentialSource.URL); err != nil {
+			return fmt.Errorf("credential_source.url: %v", err)
+		}
+	}
+	return nil
+}
+
+func validateCredSourceURL(rawURL string) error {
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		return fmt.Errorf("invalid URL %q: %v", rawURL, err)
+	}
+	if parsed.Scheme != "https" {
+		return fmt.Errorf("%q must use HTTPS", rawURL)
+	}
+	return nil
+}

pkg/asset/installconfig/gcp/session_test.go

@@ -0,0 +1,116 @@
+package gcp
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidateCredentialURLs(t *testing.T) {
+	buildCreds := func(tokenURL, saImpURL, credSourceURL string) []byte {
+		creds := map[string]interface{}{
+			"type":               "external_account",
+			"audience":           "//iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/pool/providers/provider",
+			"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
+		}
+		if tokenURL != "" {
+			creds["token_url"] = tokenURL
+		}
+		if saImpURL != "" {
+			creds["service_account_impersonation_url"] = saImpURL
+		}
+		if credSourceURL != "" {
+			creds["credential_source"] = map[string]interface{}{
+				"url": credSourceURL,
+			}
+		}
+		b, _ := json.Marshal(creds)
+		return b
+	}
+
+	cases := []struct {
+		name  string
+		creds []byte
+		err   string
+	}{
+		{
+			name:  "valid standard WIF credentials",
+			creds: buildCreds("https://sts.googleapis.com/v1/token", "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sa@proj.iam.gserviceaccount.com:generateAccessToken", "https://my-oidc-provider.example.com/token"),
+		},
+		{
+			name:  "all URL fields empty uses safe defaults",
+			creds: buildCreds("", "", ""),
+		},
+		{
+			name:  "valid credential_source.url to external OIDC provider",
+			creds: buildCreds("https://sts.googleapis.com/v1/token", "", "https://login.microsoftonline.com/tenant/oauth2/v2.0/token"),
+		},
+		{
+			name:  "non-external_account type is not validated",
+			creds: []byte(`{"type": "service_account", "token_url": "https://evil.com/steal"}`),
+		},
+		{
+			name: "custom universe domain with WIF is not supported",
+			creds: func() []byte {
+				c := map[string]interface{}{
+					"type":             "external_account",
+					"universe_domain":  "custom.example.com",
+					"token_url":        "https://sts.custom.example.com/v1/token",
+				}
+				b, _ := json.Marshal(c)
+				return b
+			}(),
+			err: `custom universe domain.*not supported.*open an RFE with Red Hat or a GitHub issue`,
+		},
+		{
+			name: "googleapis.com universe domain with WIF is allowed",
+			creds: func() []byte {
+				c := map[string]interface{}{
+					"type":             "external_account",
+					"universe_domain":  "googleapis.com",
+					"token_url":        "https://sts.googleapis.com/v1/token",
+				}
+				b, _ := json.Marshal(c)
+				return b
+			}(),
+		},
+		{
+			name:  "invalid token_url pointing to unrelated host",
+			creds: buildCreds("https://bad-host.example.com/v1/token", "", ""),
+			err:   `token_url.*must equal https://sts\.googleapis\.com/v1/token`,
+		},
+		{
+			name:  "invalid token_url with extra path",
+			creds: buildCreds("https://sts.googleapis.com/v1/token/extra", "", ""),
+			err:   `token_url.*must equal https://sts\.googleapis\.com/v1/token`,
+		},
+		{
+			name:  "invalid token_url with custom universe domain",
+			creds: buildCreds("https://sts.custom-domain.example.com/v1/token", "", ""),
+			err:   `token_url.*must equal https://sts\.googleapis\.com/v1/token`,
+		},
+		{
+			name:  "invalid service_account_impersonation_url pointing to unrelated host",
+			creds: buildCreds("https://sts.googleapis.com/v1/token", "https://bad-host.example.com/capture", ""),
+			err:   `service_account_impersonation_url.*must begin with https://iamcredentials\.googleapis\.com/`,
+		},
+		{
+			name:  "invalid credential_source.url using HTTP",
+			creds: buildCreds("https://sts.googleapis.com/v1/token", "", "http://my-oidc-provider.example.com/token"),
+			err:   `credential_source\.url.*must use HTTPS`,
+		},
+	}
+
+	for _, test := range cases {
+		t.Run(test.name, func(t *testing.T) {
+			err := validateCredentialURLs(test.creds)
+			if test.err == "" {
+				assert.NoError(t, err)
+			} else {
+				assert.Error(t, err)
+				assert.Regexp(t, test.err, err.Error())
+			}
+		})
+	}
+}