APIGOV-32943 — Okta IDP per-scope policy lifecycle, app name templates, and scope exclude list

pkg/agent/handler/accessrequest_test.go

@@ -418,6 +418,9 @@ type mockClient struct {
 	isDeleting      bool
 	subError        error
 	deleteResCalled bool
+	getTeamResult   []defs.PlatformTeam
+	getTeamErr      error
+	gotTeamQuery    map[string]string
 	t               *testing.T
 }
 
@@ -459,6 +462,11 @@ func (m *mockClient) DeleteResourceInstance(ri v1.Interface) error {
 	return nil
 }
 
+func (m *mockClient) GetTeam(query map[string]string) ([]defs.PlatformTeam, error) {
+	m.gotTeamQuery = query
+	return m.getTeamResult, m.getTeamErr
+}
+
 type mockARProvision struct {
 	expectedAccessDetails map[string]interface{}
 	expectedAPIID         string

pkg/agent/handler/credential.go

@@ -218,43 +218,52 @@ func (h *credentials) onDeleting(ctx context.Context, cred *management.Credentia
 
 	status := h.prov.CredentialDeprovision(provCreds)
 
-	h.deprovisionPostProcess(status, provCreds, logger, ctx, cred)
+	h.deprovisionPostProcess(status, provCreds, logger, ctx, cred, app)
 }
 
-func (h *credentials) deprovisionPostProcess(status prov.RequestStatus, provCreds *provCreds, logger log.FieldLogger, ctx context.Context, cred *management.Credential) {
-	if status.GetStatus() == prov.Success {
-		if provCreds.IsIDPCredential() && !isExternalCredential(cred) {
-			err := provCreds.idpProvisioner.UnregisterClient()
-			if err != nil {
-				logger.
-					WithError(err).
-					WithField("client_id", provCreds.idpProvisioner.GetIDPCredentialData().GetClientID()).
-					WithField("provider", provCreds.GetIDPProvider().GetName()).
-					Warn("error deprovisioning credential request from IDP, please ask administrator to remove the client from IdP")
-			}
-		}
-
-		ri, _ := cred.AsInstance()
-		h.client.UpdateResourceFinalizer(ri, crFinalizer, "", false)
-
-		// update sub resources when expire
-		if cred.Metadata.State != v1.ResourceDeleting {
-			cred.State.Name = v1.Inactive
-			cred.Status.Level = prov.Success.String()
-			cred.Status.Reasons = []v1.ResourceStatusReason{}
-			h.client.CreateSubResource(cred.ResourceMeta, map[string]interface{}{
-				"state": cred.State,
-			})
-			h.client.CreateSubResource(cred.ResourceMeta, map[string]interface{}{
-				"status": cred.Status,
-			})
-		}
-	} else {
+func (h *credentials) deprovisionPostProcess(status prov.RequestStatus, provCreds *provCreds, logger log.FieldLogger,
+	ctx context.Context, cred *management.Credential, app *management.ManagedApplication) {
+	if status.GetStatus() != prov.Success {
 		err := errors.New(status.GetMessage())
 		logger.WithError(err).Error("request status was not Success, skipping")
 		h.onError(ctx, cred, err)
 		h.client.CreateSubResource(cred.ResourceMeta, cred.SubResources)
+		return
+	}
+
+	if provCreds.IsIDPCredential() && !isExternalCredential(cred) {
+		clientID := provCreds.idpProvisioner.GetIDPCredentialData().GetClientID()
+		tokenURL := provCreds.GetIDPProvider().GetTokenEndpoint()
+		providerName := provCreds.GetIDPProvider().GetName()
+		logger = logger.WithField("client_id", clientID).WithField("provider", providerName).WithField("tokenURL", tokenURL)
+
+		unregisterErr := provCreds.idpProvisioner.UnregisterClient()
+		if unregisterErr != nil {
+			logger.WithError(unregisterErr).Warn("error deprovisioning credential request from IDP, please ask administrator to remove the client from IdP")
+		} else {
+			if err := removeClientIDFromManagedApp(logger, h.client, app, clientID, tokenURL); err != nil {
+				logger.WithError(err).Warn("error removing clientID from Managed App clientIDs array")
+			}
+		}
+	}
+
+	ri, _ := cred.AsInstance()
+	h.client.UpdateResourceFinalizer(ri, crFinalizer, "", false)
+
+	// update sub resources when expire
+	if cred.Metadata.State == v1.ResourceDeleting {
+		return
 	}
+
+	cred.State.Name = v1.Inactive
+	cred.Status.Level = prov.Success.String()
+	cred.Status.Reasons = []v1.ResourceStatusReason{}
+	h.client.CreateSubResource(cred.ResourceMeta, map[string]interface{}{
+		"state": cred.State,
+	})
+	h.client.CreateSubResource(cred.ResourceMeta, map[string]interface{}{
+		"status": cred.Status,
+	})
 }
 
 func (h *credentials) onPending(ctx context.Context, cred *management.Credential) *management.Credential {
@@ -272,12 +281,10 @@ func (h *credentials) onPending(ctx context.Context, cred *management.Credential
 		return cred
 	}
 
-	if provCreds.IsIDPCredential() && !isExternalCredential(cred) {
-		if err := provCreds.idpProvisioner.RegisterClient(); err != nil {
-			logger.WithError(err).Error("error provisioning credential request with IDP")
-			h.onError(ctx, cred, err)
-			return cred
-		}
+	if err := h.registerIDPClient(cred, provCreds, app, logger); err != nil {
+		logger.WithError(err).Error("error registering IDP client")
+		h.onError(ctx, cred, err)
+		return cred
 	}
 
 	status, credentialData := h.provision(provCreds)
@@ -453,10 +460,9 @@ func (h *credentials) onUpdates(ctx context.Context, cred *management.Credential
 			return cred
 		}
 
-		// if IDP and rotate the agent will register a new client
-		if action == prov.Rotate && provCreds.IsIDPCredential() && !isExternalCredential(cred) {
-			if err := provCreds.idpProvisioner.RegisterClient(); err != nil {
-				logger.WithError(err).Error("error provisioning credential request with IDP")
+		if action == prov.Rotate {
+			if err := h.registerIDPClient(cred, provCreds, app, logger); err != nil {
+				logger.WithError(err).Error("error registering IDP client")
 				h.onError(ctx, cred, err)
 				return cred
 			}
@@ -598,6 +604,24 @@ func (h *credentials) newProvCreds(cr *management.Credential, app *management.Ma
 	return provCred, nil
 }
 
+// registerIDPClient registers a new IDP client and (for Okta) persists the reference
+// on the managed app. It is a no-op when not an IDP credential or is external.
+func (h *credentials) registerIDPClient(cred *management.Credential, provCreds *provCreds, app *management.ManagedApplication, logger log.FieldLogger) error {
+	if !provCreds.IsIDPCredential() || isExternalCredential(cred) {
+		return nil
+	}
+	if err := provCreds.idpProvisioner.RegisterClient(); err != nil {
+		return fmt.Errorf("error provisioning credential request with IDP: %w", err)
+	}
+	if provCreds.GetIDPProvider().GetConfig().GetIDPType() != oauth.TypeOkta {
+		return nil
+	}
+	return persistIDPClientOnManagedApplication(logger, h.client, app,
+		provCreds.GetIDPCredentialData().GetClientID(),
+		provCreds.GetIDPProvider().GetTokenEndpoint(),
+	)
+}
+
 // GetApplicationName gets the name of the managed application
 func (c provCreds) GetApplicationName() string {
 	return c.managedApp

pkg/agent/handler/credential_test.go

@@ -729,7 +729,7 @@ type mockCredProv struct {
 func (m *mockCredProv) CredentialProvision(cr prov.CredentialRequest) (status prov.RequestStatus, credentails prov.Credential) {
 	m.expectedProvType = provision
 	v := cr.(*provCreds)
-	assert.Equal(m.t, m.expectedAppDetails, v.appDetails)
+	assertMapContains(m.t, v.appDetails, m.expectedAppDetails)
 	assert.Equal(m.t, m.expectedCredDetails, v.credDetails)
 	assert.Equal(m.t, m.expectedManagedApp, v.managedApp)
 	assert.Equal(m.t, m.expectedCredType, v.credType)
@@ -739,7 +739,7 @@ func (m *mockCredProv) CredentialProvision(cr prov.CredentialRequest) (status pr
 func (m *mockCredProv) CredentialDeprovision(cr prov.CredentialRequest) (status prov.RequestStatus) {
 	m.expectedProvType = deprovision
 	v := cr.(*provCreds)
-	assert.Equal(m.t, m.expectedAppDetails, v.appDetails)
+	assertMapContains(m.t, v.appDetails, m.expectedAppDetails)
 	assert.Equal(m.t, m.expectedCredDetails, v.credDetails)
 	assert.Equal(m.t, m.expectedManagedApp, v.managedApp)
 	assert.Equal(m.t, m.expectedCredType, v.credType)
@@ -749,13 +749,20 @@ func (m *mockCredProv) CredentialDeprovision(cr prov.CredentialRequest) (status
 func (m *mockCredProv) CredentialUpdate(cr prov.CredentialRequest) (status prov.RequestStatus, credentails prov.Credential) {
 	m.expectedProvType = update
 	v := cr.(*provCreds)
-	assert.Equal(m.t, m.expectedAppDetails, v.appDetails)
+	assertMapContains(m.t, v.appDetails, m.expectedAppDetails)
 	assert.Equal(m.t, m.expectedCredDetails, v.credDetails)
 	assert.Equal(m.t, m.expectedManagedApp, v.managedApp)
 	assert.Equal(m.t, m.expectedCredType, v.credType)
 	return m.expectedStatus, &mockProvCredential{}
 }
 
+func assertMapContains(t *testing.T, actual, expected map[string]interface{}) {
+	t.Helper()
+	for k, v := range expected {
+		assert.Equal(t, v, actual[k], "expected map to contain key %q", k)
+	}
+}
+
 func (m *mockCredProv) GetIgnoredCredentialTypes() []string {
 	return m.ignoredCredTypeNames
 }
@@ -1070,9 +1077,9 @@ func TestExternalCredentialOnPending(t *testing.T) {
 			}
 
 			p := &mockExternalCredProv{
-				t:             t,
+				t:              t,
 				expectedStatus: expectedStatus,
-				provisionErr:  tc.provisionErr,
+				provisionErr:   tc.provisionErr,
 			}
 
 			c := &credClient{

pkg/agent/handler/idpclientlifecycle.go

@@ -0,0 +1,149 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	management "github.com/Axway/agent-sdk/pkg/apic/apiserver/models/management/v1alpha1"
+	defs "github.com/Axway/agent-sdk/pkg/apic/definitions"
+	"github.com/Axway/agent-sdk/pkg/authz/oauth"
+	"github.com/Axway/agent-sdk/pkg/util"
+	"github.com/Axway/agent-sdk/pkg/util/log"
+)
+
+const (
+	oktaClientIDsAgentDetail = "oktaClientIDs"
+	tokenURLAgentDetail      = "tokenURL"
+)
+
+// persistIDPClientOnManagedApplication stores IDP client IDs on the ManagedApplication x-agent-details
+// so they can be cleaned up if the app is deleted before credential-level cleanup runs.
+func persistIDPClientOnManagedApplication(logger log.FieldLogger, client client, app *management.ManagedApplication, clientID, tokenURL string) error {
+	if app == nil || clientID == "" {
+		return nil
+	}
+
+	details := util.GetAgentDetails(app)
+	if details == nil {
+		details = make(map[string]interface{})
+	}
+
+	existing := extractClientIDs(details[oktaClientIDsAgentDetail])
+	for _, id := range existing {
+		if id == clientID {
+			return nil
+		}
+	}
+	existing = append(existing, clientID)
+
+	details[oktaClientIDsAgentDetail] = existing
+	if tokenURL != "" {
+		details[tokenURLAgentDetail] = tokenURL
+	}
+
+	if err := client.CreateSubResource(app.ResourceMeta, map[string]interface{}{defs.XAgentDetails: details}); err != nil {
+		return fmt.Errorf("could not persist IDP client reference on managed application %s: %w", app.Name, err)
+	}
+
+	if logger != nil {
+		logger.WithField("clientID", clientID).Trace("persisted IDP client reference on managed application")
+	}
+
+	return nil
+}
+
+func removeClientIDFromManagedApp(logger log.FieldLogger, client client, app *management.ManagedApplication, clientID, tokenURL string) error {
+	if app == nil || clientID == "" {
+		return nil
+	}
+
+	details := util.GetAgentDetails(app)
+	if details == nil {
+		return nil
+	}
+
+	clientIDs := extractClientIDs(details[oktaClientIDsAgentDetail])
+	if len(clientIDs) == 0 {
+		logger.Trace("empty clientIDs agent detail")
+		return nil
+	}
+
+	for i := len(clientIDs) - 1; i >= 0; i-- {
+		if clientIDs[i] != clientID {
+			continue
+		}
+		clientIDs = append(clientIDs[:i], clientIDs[i+1:]...)
+		details[oktaClientIDsAgentDetail] = clientIDs
+		if err := client.CreateSubResource(app.ResourceMeta, map[string]interface{}{defs.XAgentDetails: details}); err != nil {
+			return fmt.Errorf("could not persist IDP client reference on managed application %s: %w", app.Name, err)
+		}
+		return nil
+	}
+
+	logger.WithField("clientID", clientID).Trace("could not find the clientID to remove from managedApp x-agent-details")
+	return nil
+}
+
+// cleanupManagedApplicationIDPClients removes any tracked IDP clients for a ManagedApplication.
+func cleanupManagedApplicationIDPClients(ctx context.Context, logger log.FieldLogger, registry oauth.IdPRegistry, app *management.ManagedApplication) error {
+	if registry == nil || app == nil {
+		return nil
+	}
+
+	details := util.GetAgentDetails(app)
+	if details == nil {
+		return nil
+	}
+
+	clientIDs := extractClientIDs(details[oktaClientIDsAgentDetail])
+	if len(clientIDs) == 0 {
+		return nil
+	}
+
+	tokenURL := util.ToString(details[tokenURLAgentDetail])
+	if tokenURL == "" {
+		logger.Warn("no tokenURL in managed application x-agent-details, skipping IDP app cleanup")
+		return nil
+	}
+
+	provider, err := registry.GetProviderByTokenEndpoint(ctx, tokenURL)
+	if err != nil || provider == nil {
+		logger.WithField("tokenURL", tokenURL).Warn("no IDP provider registered for tokenURL, skipping IDP app cleanup")
+		return nil
+	}
+
+	for _, clientID := range clientIDs {
+		if err := provider.UnregisterClient(clientID, "", "", nil, ""); err != nil {
+			return fmt.Errorf("cleanupManagedApplicationIDPClients: failed for client %s: %w", clientID, err)
+		}
+		logger.WithField("clientID", clientID).Info("IDP client unregistered")
+	}
+
+	return nil
+}
+
+func extractClientIDs(raw interface{}) []string {
+	switch v := raw.(type) {
+	case []string:
+		return append([]string(nil), v...)
+	case []interface{}:
+		ids := make([]string, 0, len(v))
+		for _, item := range v {
+			if s, ok := item.(string); ok && s != "" {
+				ids = append(ids, s)
+			}
+		}
+		return ids
+	case string:
+		if v == "" {
+			return nil
+		}
+		var ids []string
+		if err := json.Unmarshal([]byte(v), &ids); err == nil {
+			return ids
+		}
+	}
+
+	return nil
+}