avoid hangs on oidc discovery unresponsive

Author: aojea

internal/node/oidc.go

@@ -302,9 +302,15 @@ func (n *SamNode) InteractiveLogin(ctx context.Context, authURL, tokenURL, clien
 	return tokenResp.AccessToken, nil
 }
 
+// oidcDiscoveryTimeout bounds a single OIDC discovery HTTP call so an
+// unresponsive issuer can't hang "join"/"run --join" indefinitely. A var
+// (not const) so tests can shrink it instead of waiting out the real value.
+var oidcDiscoveryTimeout = 10 * time.Second
+
 // DiscoverTokenURL discovers the token URL from the OIDC issuer.
 func (n *SamNode) DiscoverTokenURL(ctx context.Context, issuerURL string) (string, error) {
-	provider, err := oidc.NewProvider(ctx, issuerURL)
+	client := &http.Client{Timeout: oidcDiscoveryTimeout}
+	provider, err := oidc.NewProvider(oidc.ClientContext(ctx, client), issuerURL)
 	if err != nil {
 		return "", fmt.Errorf("failed to create OIDC provider: %w", err)
 	}
@@ -322,7 +328,8 @@ func (n *SamNode) DiscoverTokenURL(ctx context.Context, issuerURL string) (strin
 
 // DiscoverEndpoints discovers both token and authorization endpoints.
 func (n *SamNode) DiscoverEndpoints(ctx context.Context, issuerURL string) (tokenURL, authURL string, err error) {
-	provider, err := oidc.NewProvider(ctx, issuerURL)
+	client := &http.Client{Timeout: oidcDiscoveryTimeout}
+	provider, err := oidc.NewProvider(oidc.ClientContext(ctx, client), issuerURL)
 	if err != nil {
 		return "", "", fmt.Errorf("failed to create OIDC provider: %w", err)
 	}

internal/node/oidc_test.go

@@ -3,6 +3,7 @@ package node
 import (
 	"context"
 	"encoding/json"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -109,6 +110,46 @@ func TestDiscoverEndpoints(t *testing.T) {
 	}
 }
 
+// TestDiscoverEndpointsDoesNotHangOnUnresponsiveIssuer guards against an
+// unbounded hang: DiscoverEndpoints/DiscoverTokenURL used to call
+// oidc.NewProvider with no client timeout, so an issuer that accepts a
+// connection but never responds could block "join"/"run --join" forever.
+func TestDiscoverEndpointsDoesNotHangOnUnresponsiveIssuer(t *testing.T) {
+	origTimeout := oidcDiscoveryTimeout
+	oidcDiscoveryTimeout = 50 * time.Millisecond
+	defer func() { oidcDiscoveryTimeout = origTimeout }()
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to listen: %v", err)
+	}
+	defer func() { _ = ln.Close() }()
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			_ = conn // accepted but deliberately never responds, to simulate a hang
+		}
+	}()
+
+	node := &SamNode{}
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		if _, _, err := node.DiscoverEndpoints(context.Background(), "http://"+ln.Addr().String()); err == nil {
+			t.Error("expected DiscoverEndpoints to fail against an unresponsive issuer")
+		}
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("DiscoverEndpoints hung on an unresponsive issuer instead of timing out")
+	}
+}
+
 func TestInteractiveLoginWithRefresh(t *testing.T) {
 	t.Setenv("SSH_CLIENT", "")
 	t.Setenv("SSH_TTY", "")