Harden OpenID retry initialization

cwms-data-api/src/main/java/cwms/cda/security/OpenIdConnectIdentitityProvider.java

@@ -46,7 +46,7 @@ public final class OpenIdConnectIdentitityProvider implements IdentityProvider {
 
     private final ScheduledExecutorService executor = Executors.newScheduledThreadPool(1);
 
-    private AtomicReference<OpenIDConfig> config = new AtomicReference<>(null);
+    private final AtomicReference<OpenIDConfig> config = new AtomicReference<>(null);
 
     private final String wellKnownUrl;
     private final String issuer;
@@ -65,9 +65,16 @@ public OpenIdConnectIdentitityProvider() {
         } else {
             timeout = 3600;
         }
+        if (wellKnownUrl == null || wellKnownUrl.isEmpty()) {
+            log.atInfo().log("OpenID Connect well-known URL is not set; provider will remain disabled.");
+            executor.shutdown();
+            return;
+        }
         // try it once, then every 5 minutes until we get it.
         initializeProvider();
-        executor.scheduleAtFixedRate(this::initializeProvider, 0, 5, TimeUnit.MINUTES);
+        if (config.get() == null) {
+            executor.scheduleAtFixedRate(this::initializeProvider, 5, 5, TimeUnit.MINUTES);
+        }
     }
 
     private void initializeProvider()
@@ -79,10 +86,6 @@ private void initializeProvider()
             }
             try {
                 log.atFine().log("Attempting to initalize OIDC provider for %s", wellKnownUrl);
-                if (wellKnownUrl == null || wellKnownUrl.isEmpty()) {
-                    executor.shutdown(); // it won't be found, don't keep looking
-                    throw new IOException("OpenID Connect well-known URL is not set.");
-                }
                 URL wellKnown = new URL(wellKnownUrl);
                 return OpenIDConfig.from(wellKnown, clientId, idpHint, timeout);
             } catch (IOException ex) {
@@ -94,7 +97,7 @@ private void initializeProvider()
             }
             return c;
         });
-        if (foundConfig != null) {
+        if (foundConfig != null || config.get() != null) {
             executor.shutdown(); // we have it, don't need to keep polling
         }
     }
@@ -159,6 +162,9 @@ public String getName() {
 
     @Override
     public boolean canAuth(Context ctx) {
+        if (config.get() == null) {
+            return false;
+        }
         String header = ctx.header(AUTHORIZATION);
         if (header == null) {
             return false;

cwms-data-api/src/test/java/cwms/cda/security/OpenIDConfigTest.java

@@ -3,6 +3,7 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import io.swagger.v3.oas.models.security.SecurityScheme;
@@ -12,6 +13,24 @@
 
 class OpenIDConfigTest {
 
+    @Test
+    void providerRemainsDisabledWhenWellKnownUrlIsMissing() {
+        String previousWellKnown = System.getProperty(OpenIdConnectIdentitityProvider.WELL_KNOWN_PROPERTY);
+        try {
+            System.setProperty(OpenIdConnectIdentitityProvider.WELL_KNOWN_PROPERTY, "");
+
+            OpenIdConnectIdentitityProvider provider = new OpenIdConnectIdentitityProvider();
+
+            assertNull(provider.getScheme());
+        } finally {
+            if (previousWellKnown == null) {
+                System.clearProperty(OpenIdConnectIdentitityProvider.WELL_KNOWN_PROPERTY);
+            } else {
+                System.setProperty(OpenIdConnectIdentitityProvider.WELL_KNOWN_PROPERTY, previousWellKnown);
+            }
+        }
+    }
+
     @Test
     void buildSchemeUsesWellKnownDiscoveryUrlWithoutHttpAuthScheme() {
         SecurityScheme scheme = OpenIDConfig.buildScheme(

docker-compose.yml

@@ -79,6 +79,7 @@ services:
       - ./compose_files/api_entry.sh:/api_entry.sh:ro
       - ./compose_files/proxy_auth.sh:/proxy_auth.sh:ro
     environment:
+      - APP_PORT=${APP_PORT:-8081}
       - JAVA_OPTS=-Dproperties.file=/conf/features.properties -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005 -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true
       - CDA_JDBC_DRIVER=oracle.jdbc.driver.OracleDriver
       - CDA_JDBC_URL=jdbc:oracle:thin:@db/FREEPDB1