Filter inactive and private oidc auth methods from unauthenticated list requests (#1110)

internal/auth/auth.go

@@ -42,6 +42,10 @@ const (
 	AuthTokenTypeRecoveryKms
 )
 
+const (
+	AnonymousUserId = "u_anon"
+)
+
 type key int
 
 var verifierKey key
@@ -238,7 +242,7 @@ func Verify(ctx context.Context, opt ...Option) (ret VerifyResults) {
 			// If the anon user was used (either no token, or invalid (perhaps
 			// expired) token), return a 401. That way if it's an authn'd user
 			// that is not authz'd we'll return 403 to be explicit.
-			if ret.UserId == "u_anon" {
+			if ret.UserId == AnonymousUserId {
 				ret.Error = handlers.UnauthenticatedError()
 			}
 			return
@@ -381,7 +385,7 @@ func (v verifier) performAuthCheck() (aclResults perms.ACLResults, userId string
 	// Make the linter happy
 	_ = retErr
 	scopeInfo = new(scopes.ScopeInfo)
-	userId = "u_anon"
+	userId = AnonymousUserId
 	var accountId string
 
 	// Validate the token and fetch the corresponding user ID
@@ -416,7 +420,7 @@ func (v verifier) performAuthCheck() (aclResults perms.ACLResults, userId string
 			userId = at.GetIamUserId()
 			if userId == "" {
 				v.logger.Warn("perform auth check: valid token did not map to a user, likely because no account is associated with the user any longer; continuing as u_anon", "token_id", at.GetPublicId())
-				userId = "u_anon"
+				userId = AnonymousUserId
 				accountId = ""
 			}
 		}

internal/auth/oidc/service_callback_test.go

@@ -114,20 +114,20 @@ func Test_Callback(t *testing.T) {
 	require.NoError(t, err)
 
 	tests := []struct {
-		name                 string
-		setup                func()               // provide a simple way to do some prework before the test.
-		oidcRepoFn           OidcRepoFactory      // returns a new oidc repo
-		iamRepoFn            IamRepoFactory       // returns a new iam repo
-		atRepoFn             AuthTokenRepoFactory // returns a new auth token repo
-		am                   *AuthMethod          // the authmethod for the test
-		state                string               // state parameter for test provider and Callback(...)
-		code                 string               // code parameter for test provider and Callback(...)
-		wantSubject          string               // sub claim from id token
-		wantInfoName         string               // name claim from userinfo
-		wantInfoEmail        string               // email claim from userinfo
-		wantFinalRedirect    string               // final redirect from Callback(...)
-		wantErrMatch         *errors.Template     // error template to match
-		wantErrContains      string               // error string should contain
+		name              string
+		setup             func()               // provide a simple way to do some prework before the test.
+		oidcRepoFn        OidcRepoFactory      // returns a new oidc repo
+		iamRepoFn         IamRepoFactory       // returns a new iam repo
+		atRepoFn          AuthTokenRepoFactory // returns a new auth token repo
+		am                *AuthMethod          // the authmethod for the test
+		state             string               // state parameter for test provider and Callback(...)
+		code              string               // code parameter for test provider and Callback(...)
+		wantSubject       string               // sub claim from id token
+		wantInfoName      string               // name claim from userinfo
+		wantInfoEmail     string               // email claim from userinfo
+		wantFinalRedirect string               // final redirect from Callback(...)
+		wantErrMatch      *errors.Template     // error template to match
+		wantErrContains   string               // error string should contain
 	}{
 		{
 			name:              "simple", // must remain the first test
@@ -234,15 +234,15 @@ func Test_Callback(t *testing.T) {
 			wantErrContains: "missing auth method",
 		},
 		{
-			name:                 "mismatch-auth-method",
-			oidcRepoFn:           repoFn,
-			iamRepoFn:            iamRepoFn,
-			atRepoFn:             atRepoFn,
-			am:                   testAuthMethod,
-			state:                testState(t, testAuthMethod2, kmsCache, testTokenRequestId, 2000*time.Second, "https://testcontroler.com/hi-alice", testConfigHash, testNonce),
-			code:                 "simple",
-			wantErrMatch:         errors.T(errors.InvalidParameter),
-			wantErrContains:      "auth method id does not match request wrapper auth method id",
+			name:            "mismatch-auth-method",
+			oidcRepoFn:      repoFn,
+			iamRepoFn:       iamRepoFn,
+			atRepoFn:        atRepoFn,
+			am:              testAuthMethod,
+			state:           testState(t, testAuthMethod2, kmsCache, testTokenRequestId, 2000*time.Second, "https://testcontroler.com/hi-alice", testConfigHash, testNonce),
+			code:            "simple",
+			wantErrMatch:    errors.T(errors.InvalidParameter),
+			wantErrContains: "auth method id does not match request wrapper auth method id",
 		},
 		{
 			name:            "bad-state-encoding",

internal/auth/option.go

@@ -33,7 +33,9 @@ type options struct {
 }
 
 func getDefaultOptions() options {
-	return options{}
+	return options{
+		withUserId: AnonymousUserId,
+	}
 }
 
 func WithScopeId(id string) Option {

internal/auth/options_test.go

@@ -14,7 +14,9 @@ import (
 func Test_GetOpts(t *testing.T) {
 	t.Parallel()
 	opts := getOpts()
-	assert.Equal(t, options{}, opts)
+	assert.Equal(t, options{
+		withUserId: AnonymousUserId,
+	}, opts)
 
 	withKms := new(kms.Kms)
 	res := new(perms.Resource)