feat: add OIDC endpoint relaxations for private/isolated networks

Closes #2364

`AssumeRoleWithWebIdentity` only ever trusted an `OIDC` provider reachable over verified `https`, at a publicly routable address, on the implicit `:443`. That posture is right for an internet-facing IdP but rejects every address an internal one can have, so a `SPIFFE/SPIRE` OIDC discovery provider in the same cluster — or as a sidecar in the same pod — could never be registered, let alone verified against, and no setting could express "this private address is the IdP".

Two opt-in flags on `versitygw iam`, both off by default:

`--oidc-allow-private-endpoints`
Permit a provider `Url` resolving to a loopback/private/link-local address, and an explicit port. Transport is unchanged: still `https`, still fully verified (a self-signed in-cluster cert is trusted the way AWS documents, through `ThumbprintList`).

`--oidc-allow-insecure-transport`
Additionally permit plaintext `http` provider URLs, discovery/JWKS endpoints and redirects, and drop TLS verification (`thumbprint` pinning included) for `https` ones.

Both apply uniformly to the thumbprint auto-fetch at `CreateOpenIDConnectProvider` time and to the discovery-document plus `JWKS` fetch at `AssumeRoleWithWebIdentity` time. Neither weakens anything past the endpoint: signature verification, issuer matching, audience and trust policy evaluation are untouched, and the DNS-resolve-once/dial-the-resolved-IP shape stays in place so a rebind still cannot redirect a connection.

An `http` provider keeps its scheme in its stored `Url`, `ARN` and `iss` matching, rather than being stripped like an `https` one — otherwise `"http://host"` and `"https://host"` would collapse onto a single ARN and storage key and each could satisfy the other's trust policy. It also stores an empty `ThumbprintList` rather than failing: a plaintext provider presents no certificate to thumbprint.

Helm: `iamServer.oidc.{allowPrivateEndpoints,allowInsecureTransport}`, alongside `disableThumbprintAutofetch` moved into the same block (the flat `iamServer.disableOidcThumbprintAutofetch` stays honored). Chart `0.4.1 -> 0.4.2`.

The WebUI's create-provider form no longer rejects `http` URLs and ports client-side; it cannot see the service's settings, so those two rules are left to the server, whose error surfaces as a toast like any other.

iamapi/controller.go

@@ -32,18 +32,20 @@ import (
 
 type IAMApiController struct {
 	store storage.Storer
-	// oidcThumbprintAutoFetchDisabled disables CreateOpenIDConnectProvider's
-	// TLS auto-fetch fallback when ThumbprintList is omitted (operational
-	// safety valve for restricted/air-gapped deployments); set via
-	// iamapi.WithOIDCThumbprintAutoFetchDisabled(). Defaults to false
-	// (auto-fetch enabled), matching real AWS behavior.
-	oidcThumbprintAutoFetchDisabled bool
+	// oidc holds the OIDC provider settings; see OIDCConfig. Its zero value
+	// is the default AWS-matching posture: auto-fetch enabled, and only
+	// verified https endpoints at publicly routable addresses.
+	oidc OIDCConfig
+	// oidcPolicy is oidc's endpoint relaxations in the form iamutil's URL
+	// validation and fetch helpers take, projected once at construction.
+	oidcPolicy iamutil.OIDCEndpointPolicy
 }
 
-func NewController(store storage.Storer, oidcThumbprintAutoFetchDisabled bool) IAMApiController {
+func NewController(store storage.Storer, oidc OIDCConfig) IAMApiController {
 	return IAMApiController{
-		store:                           store,
-		oidcThumbprintAutoFetchDisabled: oidcThumbprintAutoFetchDisabled,
+		store:      store,
+		oidc:       oidc,
+		oidcPolicy: oidc.endpointPolicy(),
 	}
 }
 
@@ -1035,7 +1037,7 @@ func (c IAMApiController) CreateOpenIDConnectProvider(ctx fiber.Ctx) (*Response,
 		debuglogger.Logf("missing required CreateOpenIDConnectProvider parameter: Url")
 		return nil, iamerr.MissingValue("url")
 	}
-	url, err := iamutil.ValidateOIDCProviderURL(rawURL)
+	url, err := iamutil.ValidateOIDCProviderURL(rawURL, c.oidcPolicy)
 	if err != nil {
 		return nil, err
 	}
@@ -1052,16 +1054,24 @@ func (c IAMApiController) CreateOpenIDConnectProvider(ctx fiber.Ctx) (*Response,
 
 	thumbprints := iamutil.ParseStringList(ctx, "ThumbprintList")
 	if len(thumbprints) == 0 {
-		if c.oidcThumbprintAutoFetchDisabled {
+		switch {
+		case iamutil.IsInsecureOIDCProviderURL(url):
+			// A plaintext http provider never presents a certificate, so
+			// there is nothing to auto-fetch and nothing for a later JWKS
+			// fetch to pin against: an empty ThumbprintList is the accurate
+			// record of that, not a missing one.
+			debuglogger.Logf("CreateOpenIDConnectProvider: %q is a plaintext http provider; storing an empty ThumbprintList", url)
+		case c.oidc.ThumbprintAutoFetchDisabled:
 			debuglogger.Logf("CreateOpenIDConnectProvider: ThumbprintList omitted and auto-fetch is disabled")
 			return nil, iamerr.MissingValue("thumbprintList")
+		default:
+			fetched, err := iamutil.FetchThumbprint(ctx.Context(), url, c.oidcPolicy)
+			if err != nil {
+				debuglogger.Logf("failed to auto-fetch OIDC thumbprint for url %q: %v", url, err)
+				return nil, err
+			}
+			thumbprints = []string{fetched}
 		}
-		fetched, err := iamutil.FetchThumbprint(ctx.Context(), url)
-		if err != nil {
-			debuglogger.Logf("failed to auto-fetch OIDC thumbprint for url %q: %v", url, err)
-			return nil, err
-		}
-		thumbprints = []string{fetched}
 	} else {
 		if err := iamutil.ValidateThumbprintList(thumbprints, false); err != nil {
 			return nil, err
@@ -1450,7 +1460,7 @@ func (c IAMApiController) AssumeRoleWithWebIdentity(ctx fiber.Ctx) (*Response, e
 		return nil, iamerr.InvalidIdentityTokenClaims()
 	}
 
-	verifiedClaims, err := iamutil.VerifyWebIdentitySignature(ctx.Context(), webIdentityToken, provider.Url, provider.ThumbprintList)
+	verifiedClaims, err := iamutil.VerifyWebIdentitySignature(ctx.Context(), webIdentityToken, provider.Url, provider.ThumbprintList, c.oidcPolicy)
 	if err != nil {
 		return nil, err
 	}