oauth2: resolve the OIDC authorize endpoint server side, fix the login page

- discover and store the authorization endpoint at registration so the UI
  redirects without reading the discovery document from the browser, which
  removed the IdP CORS requirement; the UI falls back to discovery when the
  endpoint is not stored
- build the authorize URL with the URL API so an endpoint that already has
  a query component is preserved
- restore the global generic provider list when the domain field is cleared
  so stale domain-specific buttons are not shown

Author: rootnomad

api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java

@@ -84,6 +84,16 @@ default String verifySecretCodeAndFetchEmail(String secretCode, Long domainId, S
         return verifySecretCodeAndFetchEmail(secretCode, domainId, providerName);
     }
 
+    /**
+     * Resolves the authorization endpoint for the registration whose issuer URL is given, so the UI can
+     * redirect without reading the discovery document from the browser. Implementations that do not use
+     * discovery return null.
+     * @return the authorization endpoint, or null
+     */
+    default String discoverAuthorizeEndpoint(String issuerUrl) {
+        return null;
+    }
+
     /**
      * Fetches email using the accessToken
      * @return returns email

plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java

@@ -214,6 +214,13 @@ public OauthProviderVO registerOauthProvider(RegisterOAuthProviderCmd cmd) {
             }
         }
 
+        if (StringUtils.isNotBlank(type) && StringUtils.isBlank(authorizeUrl) && StringUtils.isNotBlank(issuerUrl)) {
+            UserOAuth2Authenticator authenticator = userOAuth2AuthenticationProvidersMap.get(type.toLowerCase());
+            if (authenticator != null) {
+                authorizeUrl = authenticator.discoverAuthorizeEndpoint(issuerUrl);
+            }
+        }
+
         return saveOauthProvider(provider, description, clientId, secretKey, redirectUri, authorizeUrl, tokenUrl, domainId, type, issuerUrl);
     }
 

plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/oidc/GenericOIDCOAuth2Provider.java

@@ -208,6 +208,14 @@ protected OauthProviderVO findRegistration(String providerName, Long domainId) {
         return provider;
     }
 
+    @Override
+    public String discoverAuthorizeEndpoint(String issuerUrl) {
+        if (StringUtils.isBlank(issuerUrl)) {
+            return null;
+        }
+        return metadataCache.get(StringUtils.trim(issuerUrl), this::discover).getAuthorizationEndpoint();
+    }
+
     protected OIDCMetadata getMetadata(OauthProviderVO provider) {
         String issuerUrl = StringUtils.trimToNull(provider.getIssuerUrl());
         if (issuerUrl == null) {

ui/src/views/auth/Login.vue

@@ -305,6 +305,7 @@ export default {
       oauthKeycloakRedirectUri: '',
       oauthKeycloakAuthorizeUrl: '',
       oauthGenericProviders: [],
+      globalGenericProviders: [],
       oauthLoading: false,
       oauthDomainQueried: false,
       loginType: 0,
@@ -406,6 +407,7 @@ export default {
           const oauthproviders = response.listoauthproviderresponse.oauthprovider || []
           this.oauthGenericProviders = oauthproviders.filter(item => item.type === 'oidc' && (item.enabled === true || item.enabled === 'true'))
           if (!domain) {
+            this.globalGenericProviders = this.oauthGenericProviders
             oauthproviders.forEach(item => {
               if (item.provider === 'google') {
                 this.googleprovider = item.enabled
@@ -498,6 +500,7 @@ export default {
         this.fetchOauthProviders(domain)
       } else {
         this.oauthDomainQueried = false
+        this.oauthGenericProviders = this.globalGenericProviders
         this.oauthGithubProvider = this.githubprovider
         this.oauthGoogleProvider = this.googleprovider
         this.oauthKeycloakProvider = this.keycloakprovider
@@ -530,8 +533,7 @@ export default {
     loginWithGenericOidc (provider) {
       this.handleDomain()
       this.$store.commit('SET_OAUTH_PROVIDER_USED_TO_LOGIN', provider.provider)
-      const discoveryUrl = provider.issuerurl.replace(/\/$/, '') + '/.well-known/openid-configuration'
-      return fetch(discoveryUrl).then(response => response.json()).then(config => {
+      const redirectToProvider = (authorizationEndpoint) => {
         const state = this.randomToken()
         const nonce = this.randomToken()
         try {
@@ -546,7 +548,17 @@ export default {
           state: state,
           nonce: nonce
         }
-        window.location.href = `${config.authorization_endpoint}?${new URLSearchParams(options).toString()}`
+        const authorizeUrl = new URL(authorizationEndpoint)
+        Object.entries(options).forEach(([key, value]) => authorizeUrl.searchParams.set(key, value))
+        window.location.href = authorizeUrl.toString()
+      }
+      if (provider.authorizeurl) {
+        redirectToProvider(provider.authorizeurl)
+        return
+      }
+      const discoveryUrl = provider.issuerurl.replace(/\/$/, '') + '/.well-known/openid-configuration'
+      return fetch(discoveryUrl).then(response => response.json()).then(config => {
+        redirectToProvider(config.authorization_endpoint)
       }).catch(() => {
         this.$notification.error({
           message: this.$t('label.error'),