checktext: |-
  From a web browser, go to the Openshift web console to login (logout
  if already logged in). Verify that the DOD notice and consent banner is
  displayed before proceeding to the login page.

  If the DOD notice and consent banner is not displayed, this is a finding.

fixtext: |-
  The following steps may be used to provide a custom provider selection
  page that will display the DOD notice and consent banner. This will replace
  OpenShift's default the login providers selection page. Please note
  that depending on the number and type of identity providers configured,
  it is possible that these pages will not be used. If that is the case,
  then it is the responsibility of the identity provider being used to
  display the DOD notice and consent banner.

  1. Create a providers selection page template

  > oc adm create-provider-selection-template > providers.html

  2. Edit the template to add the DOD notice and consent banner by adding
  the following lines at the end of the html body. In addition, any look
  and feel customizations should also be applied to the pages.

      <script type="text/javascript">
        window.onload = function(){
                  alert("You are accessing a U.S. Government (USG)
                  Information System (IS) that is provided for USG-authorized
                  use only. By using this IS (which includes any device
                  attached to this IS), you consent to the following
                  conditions:\n\n-The USG routinely intercepts and monitors
                  communications on this IS for purposes including, but
                  not limited to, penetration testing, COMSEC monitoring,
                  network operations and defense, personnel misconduct
                  (PM), law enforcement (LE), and counterintelligence (CI)
                  investigations.\n\n-At any time, the USG may inspect and
                  seize data stored on this IS.\n\n-Communications using,
                  or data stored on, this IS are not private, are subject to
                  routine monitoring, interception, and search, and may be
                  disclosed or used for any USG-authorized purpose.\n\n-This
                  IS includes security measures (e.g., authentication and
                  access controls) to protect USG interests--not for your
                  personal benefit or privacy.\n\n-Notwithstanding the above,
                  using this IS does not constitute consent to PM, LE or
                  CI investigative searching or monitoring of the content
                  of privileged communications, or work product, related
                  to personal representation or services by attorneys,
                  psychotherapists, or clergy, and their assistants. Such
                  communications and work product are private and
                  confidential. See User Agreement for details.");
        }
      </script>

  3. Add custom providers selection to OpenShift

  > oc create secret generic providers-template --from-file=providers.html -n openshift-config
  > oc patch oauths cluster --type='merge' -p '{"spec":{"templates":{"providerSelection":{"name":"providers-template"}}}}'

srg_requirement: |-
  Red Hat OpenShift Container Platform 4 must display the Standard Mandatory
  DoD Notice and Consent Banner before granting access to platform components.
