
title: Ensure that the OpenShift OAuth provider selection is set

{{% set default_jqfilter = '.spec' %}}
{{% set default_api_path = '/apis/config.openshift.io/v1/oauths/cluster' %}}
{{% set hypershift_path = '/apis/hypershift.openshift.io/v1beta1/namespaces/{{.hypershift_namespace_prefix}}/hostedclusters/{{.hypershift_cluster}}' %}}
{{% set hypershift_jqfilter = '.spec.configuration.oauth' %}}
{{% set custom_api_path = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_path ~ '{{else}}' ~  default_api_path ~ '{{end}}' %}}
{{% set custom_jqfilter = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_jqfilter ~ '{{else}}' ~  default_jqfilter ~ '{{end}}' %}}
{{% set dump_path = default_api_path ~ ',' ~ default_jqfilter ~ ',' ~ custom_jqfilter %}}

description: |-
  Custom login pages can be helpful to show users a branded page that they
  trust and expect before being redirected to the authentication provider.
  <br/>

  This is achievable via the OAuth object by creating a custom login template,
  storing it in a Kubernetes Secret and referencing it in the appropriate
  field as
  {{{ weblink(link="https://docs.openshift.com/container-platform/latest/web_console/customizing-the-web-console.html#customizing-the-login-page_customizing-web-console",
              text="described in the documentation") }}}

rationale: |-
  Displays to users organization-defined IdP selection

identifiers:
  cce@ocp4: CCE-90666-9

severity: medium

references:
  nist: AC-8
  srg: SRG-APP-000068-CTR-000120

platform: not ocp4-on-hypershift-hosted

ocil_clause: 'provider selection is not set'

ocil: |-
  To verify that provider selection is properly set, do the following:
  <pre>$ oc get oauths cluster</pre>
  make sure that the provider selection is set in the path
  <tt>.spec.templates.providerSelection.name</tt>, and references a valid secret.

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: {{{ openshift_filtered_path(default_api_path, default_jqfilter) }}}
    yamlpath: ".templates.providerSelection.name"
    values:
    - value: ".+"
      operation: "pattern match"
      type: "string"
