always initialize idp token endpoint for service accounts

Author: MichaelEischer

internal/cmd/ske/kubeconfig/login/login.go

@@ -317,11 +317,6 @@ func getAccessToken(params *types.CmdParams) (string, error) {
 		return "", &cliErr.SessionExpiredError{}
 	}
 
-	err = auth.EnsureIDPTokenEndpoint(params.Printer)
-	if err != nil {
-		return "", err
-	}
-
 	return accessToken, nil
 }
 

internal/pkg/auth/auth.go

@@ -216,18 +216,3 @@ func GetValidAccessToken(p *print.Printer) (string, error) {
 	// Return the new access token
 	return utf.accessToken, nil
 }
-
-// EnsureIDPTokenEndpoint ensures that the `IDP_TOKEN_ENDPOINT` auth field is set.
-// This field is by default only initialized for user accounts. Call this method to also
-// initialize it for service accounts.
-func EnsureIDPTokenEndpoint(p *print.Printer) error {
-	idpTokenEndpoint, err := GetAuthField(IDP_TOKEN_ENDPOINT)
-	if err != nil {
-		return fmt.Errorf("failed to check idp token endpoint configuration value: %w", err)
-	}
-	if idpTokenEndpoint == "" {
-		_, err := retrieveIDPWellKnownConfig(p)
-		return err
-	}
-	return nil
-}

internal/pkg/auth/service_account.go

@@ -36,6 +36,14 @@ var _ http.RoundTripper = &keyFlowWithStorage{}
 // It returns the email associated with the service account
 // If disableWriting is set to true the credentials are not stored on disk (keyring, file).
 func AuthenticateServiceAccount(p *print.Printer, rt http.RoundTripper, disableWriting bool) (email, accessToken string, err error) {
+	if !disableWriting {
+		// Ensure idp token endpoint is set
+		_, err = retrieveIDPWellKnownConfig(p)
+		if err != nil {
+			return "", "", err
+		}
+	}
+
 	authFields := make(map[authFieldKey]string)
 	var authFlowType AuthFlow
 	switch flow := rt.(type) {
@@ -80,8 +88,6 @@ func AuthenticateServiceAccount(p *print.Printer, rt http.RoundTripper, disableW
 		return "", "", fmt.Errorf("compute session expiration timestamp: %w", err)
 	}
 	authFields[SESSION_EXPIRES_AT_UNIX] = sessionExpiresAtUnix
-	// clear idp token endpoint as it is not set by default for service accounts
-	authFields[IDP_TOKEN_ENDPOINT] = ""
 
 	if !disableWriting {
 		err = SetAuthFlow(authFlowType)

internal/pkg/auth/service_account_test.go

@@ -153,6 +153,7 @@ func TestAuthenticateServiceAccount(t *testing.T) {
 			}
 
 			p := print.NewPrinter()
+			p.AssumeYes = true
 			email, _, err := AuthenticateServiceAccount(p, flow, false)
 
 			if !tt.isValid {