Add pinniped_supported_identity_provider_types to the IDP discovery endpoint

apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go.tmpl

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.24/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.25/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.26/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.27/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.28/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.29/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/1.30/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

generated/latest/apis/supervisor/idpdiscovery/v1alpha1/types_supervisor_idp_discovery.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package v1alpha1
@@ -55,6 +55,7 @@ type OIDCDiscoveryResponseIDPEndpoint struct {
 // IDPDiscoveryResponse is the response of a FederationDomain's identity provider discovery endpoint.
 type IDPDiscoveryResponse struct {
 	PinnipedIDPs              []PinnipedIDP              `json:"pinniped_identity_providers"`
+	PinnipedSupportedIDPTypes []PinnipedSupportedIDPType `json:"pinniped_supported_identity_provider_types"`
 }
 
 // PinnipedIDP describes a single identity provider as included in the response of a FederationDomain's
@@ -64,3 +65,8 @@ type PinnipedIDP struct {
 	Type  IDPType   `json:"type"`
 	Flows []IDPFlow `json:"flows,omitempty"`
 }
+
+// PinnipedSupportedIDPType describes a single identity provider type.
+type PinnipedSupportedIDPType struct {
+	Type IDPType `json:"type"`
+}

internal/federationdomain/endpoints/idpdiscovery/idp_discovery_handler.go

@@ -37,15 +37,23 @@ func NewHandler(upstreamIDPs federationdomainproviders.FederationDomainIdentityP
 }
 
 func responseAsJSON(upstreamIDPs federationdomainproviders.FederationDomainIdentityProvidersListerI) ([]byte, error) {
-	r := v1alpha1.IDPDiscoveryResponse{PinnipedIDPs: []v1alpha1.PinnipedIDP{}}
+	r := v1alpha1.IDPDiscoveryResponse{
+		PinnipedSupportedIDPTypes: []v1alpha1.PinnipedSupportedIDPType{
+			{Type: v1alpha1.IDPTypeActiveDirectory},
+			{Type: v1alpha1.IDPTypeLDAP},
+			{Type: v1alpha1.IDPTypeOIDC},
+		},
+	}
 
+	upstreams := upstreamIDPs.GetIdentityProviders()
+	r.PinnipedIDPs = make([]v1alpha1.PinnipedIDP, len(upstreams))
 	// The cache of IDPs could change at any time, so always recalculate the list.
-	for _, federationDomainIdentityProvider := range upstreamIDPs.GetIdentityProviders() {
+	for i, federationDomainIdentityProvider := range upstreams {
-		r.PinnipedIDPs = append(r.PinnipedIDPs, v1alpha1.PinnipedIDP{
+		r.PinnipedIDPs[i] = v1alpha1.PinnipedIDP{
 			Name:  federationDomainIdentityProvider.GetDisplayName(),
 			Type:  federationDomainIdentityProvider.GetIDPDiscoveryType(),
 			Flows: federationDomainIdentityProvider.GetIDPDiscoveryFlows(),
-		})
+		}
 	}
 
 	// Nobody like an API that changes the results unnecessarily. :)

internal/federationdomain/endpoints/idpdiscovery/idp_discovery_handler_test.go

@@ -22,6 +22,7 @@ func TestIDPDiscovery(t *testing.T) {
 
 		method    string
 		path      string
+		idpLister *testidplister.TestFederationDomainIdentityProvidersListerFinder
 
 		wantStatus                 int
 		wantContentType            string
@@ -33,6 +34,16 @@ func TestIDPDiscovery(t *testing.T) {
 			name:   "happy path",
 			method: http.MethodGet,
 			path:   "/some/path" + oidc.WellKnownEndpointPath,
+			idpLister: testidplister.NewUpstreamIDPListerBuilder().
+				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("z-some-oidc-idp").WithAllowPasswordGrant(true).Build()).
+				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("x-some-oidc-idp").Build()).
+				WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("a-some-ldap-idp").Build()).
+				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("a-some-oidc-idp").Build()).
+				WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ldap-idp").Build()).
+				WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("x-some-ldap-idp").Build()).
+				WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ad-idp").Build()).
+				WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("y-some-ad-idp").Build()).
+				BuildFederationDomainIdentityProvidersListerFinder(),
 			wantStatus:      http.StatusOK,
 			wantContentType: "application/json",
 			wantFirstResponseBodyJSON: here.Doc(`{
@@ -45,6 +56,11 @@ func TestIDPDiscovery(t *testing.T) {
 					{"name": "z-some-ad-idp",   "type": "activedirectory", "flows": ["cli_password", "browser_authcode"]},
 					{"name": "z-some-ldap-idp", "type": "ldap",            "flows": ["cli_password", "browser_authcode"]},
 					{"name": "z-some-oidc-idp", "type": "oidc",            "flows": ["browser_authcode", "cli_password"]}
+				],
+				"pinniped_supported_identity_provider_types": [
+					{"type": "activedirectory"},
+					{"type": "ldap"},
+					{"type": "oidc"}
 				]
 			}`),
 			wantSecondResponseBodyJSON: here.Doc(`{
@@ -55,6 +71,43 @@ func TestIDPDiscovery(t *testing.T) {
 					{"name": "some-other-ldap-idp-2", "type": "ldap",            "flows": ["cli_password", "browser_authcode"]},
 					{"name": "some-other-oidc-idp-1", "type": "oidc",            "flows": ["browser_authcode", "cli_password"]},
 					{"name": "some-other-oidc-idp-2", "type": "oidc",            "flows": ["browser_authcode"]}
+				],
+				"pinniped_supported_identity_provider_types": [
+					{"type": "activedirectory"},
+					{"type": "ldap"},
+					{"type": "oidc"}
+				]
+			}`),
+		},
+		{
+			name:   "no starting IDPs still returns supported IDP types",
+			method: http.MethodGet,
+			path:   "/some/path" + oidc.WellKnownEndpointPath,
+			idpLister: testidplister.NewUpstreamIDPListerBuilder().
+				BuildFederationDomainIdentityProvidersListerFinder(),
+			wantStatus:      http.StatusOK,
+			wantContentType: "application/json",
+			wantFirstResponseBodyJSON: here.Doc(`{
+				"pinniped_identity_providers": [],
+				"pinniped_supported_identity_provider_types": [
+					{"type": "activedirectory"},
+					{"type": "ldap"},
+					{"type": "oidc"}
+				]
+			}`),
+			wantSecondResponseBodyJSON: here.Doc(`{
+				"pinniped_identity_providers": [
+					{"name": "some-other-ad-idp-1",   "type": "activedirectory", "flows": ["cli_password", "browser_authcode"]},
+					{"name": "some-other-ad-idp-2",   "type": "activedirectory", "flows": ["cli_password", "browser_authcode"]},
+					{"name": "some-other-ldap-idp-1", "type": "ldap",            "flows": ["cli_password", "browser_authcode"]},
+					{"name": "some-other-ldap-idp-2", "type": "ldap",            "flows": ["cli_password", "browser_authcode"]},
+					{"name": "some-other-oidc-idp-1", "type": "oidc",            "flows": ["browser_authcode", "cli_password"]},
+					{"name": "some-other-oidc-idp-2", "type": "oidc",            "flows": ["browser_authcode"]}
+				],
+				"pinniped_supported_identity_provider_types": [
+					{"type": "activedirectory"},
+					{"type": "ldap"},
+					{"type": "oidc"}
 				]
 			}`),
 		},
@@ -62,6 +115,9 @@ func TestIDPDiscovery(t *testing.T) {
 			name:   "bad method",
 			method: http.MethodPost,
 			path:   oidc.WellKnownEndpointPath,
+			idpLister: testidplister.NewUpstreamIDPListerBuilder().
+				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("some-oidc-idp").Build()).
+				BuildFederationDomainIdentityProvidersListerFinder(),
 			wantStatus:      http.StatusMethodNotAllowed,
 			wantContentType: "text/plain; charset=utf-8",
 			wantBodyString:  "Method not allowed (try GET)\n",
@@ -69,18 +125,8 @@ func TestIDPDiscovery(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			idpLister := testidplister.NewUpstreamIDPListerBuilder().
+			require.NotNil(t, test.idpLister)
-				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("z-some-oidc-idp").WithAllowPasswordGrant(true).Build()).
+			handler := NewHandler(test.idpLister)
-				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("x-some-oidc-idp").Build()).
-				WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("a-some-ldap-idp").Build()).
-				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("a-some-oidc-idp").Build()).
-				WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ldap-idp").Build()).
-				WithLDAP(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("x-some-ldap-idp").Build()).
-				WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("z-some-ad-idp").Build()).
-				WithActiveDirectory(oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("y-some-ad-idp").Build()).
-				BuildFederationDomainIdentityProvidersListerFinder()
-
-			handler := NewHandler(idpLister)
 			req := httptest.NewRequest(test.method, test.path, nil)
 			rsp := httptest.NewRecorder()
 			handler.ServeHTTP(rsp, req)
@@ -98,15 +144,15 @@ func TestIDPDiscovery(t *testing.T) {
 			}
 
 			// Change the list of IDPs in the cache.
-			idpLister.SetLDAPIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
+			test.idpLister.SetLDAPIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
 				oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ldap-idp-1").Build(),
 				oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ldap-idp-2").Build(),
 			})
-			idpLister.SetOIDCIdentityProviders([]*oidctestutil.TestUpstreamOIDCIdentityProvider{
+			test.idpLister.SetOIDCIdentityProviders([]*oidctestutil.TestUpstreamOIDCIdentityProvider{
 				oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("some-other-oidc-idp-1").WithAllowPasswordGrant(true).Build(),
 				oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("some-other-oidc-idp-2").Build(),
 			})
-			idpLister.SetActiveDirectoryIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
+			test.idpLister.SetActiveDirectoryIdentityProviders([]*oidctestutil.TestUpstreamLDAPIdentityProvider{
 				oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ad-idp-2").Build(),
 				oidctestutil.NewTestUpstreamLDAPIdentityProviderBuilder().WithName("some-other-ad-idp-1").Build(),
 			})

internal/federationdomain/endpointsmanager/manager_test.go

@@ -118,8 +118,18 @@ func TestManager(t *testing.T) {
 			r.Equal(http.StatusOK, recorder.Code, "unexpected response:", recorder)
 			responseBody, err := io.ReadAll(recorder.Body)
 			r.NoError(err)
-			r.Equal(
+
-				fmt.Sprintf(`{"pinniped_identity_providers":[%s]}`+"\n", strings.Join(expectedIDPJSONList, ",")),
+			expectedResponse := here.Docf(`{
+				"pinniped_identity_providers": [%s],
+				"pinniped_supported_identity_provider_types": [
+					{"type":"activedirectory"},
+					{"type":"ldap"},
+					{"type":"oidc"}
+				]
+}`, strings.Join(expectedIDPJSONList, ","))
+
+			r.JSONEq(
+				expectedResponse,
 				string(responseBody),
 			)
 		}