Invalid IDP metadata shouldn't generate a 5xx error

[juan-fdz-hawa]

See https://github.com/fleetdm/confidential/issues/2888 for context - basically if the Metadata returned by the IDP is invalid, we don't want to return a 500 status code.

(It should likely return 400 Bad Request)

[sharon-fdm]

@juan-fdz-hawa
Please add more info here as well.

[juan-fdz-hawa]

When setting up SSO, the user has two options regarding Metadata, they can either specify the metada inline:

Or they can provide a Metadata URL:

If the endpoint specified in the Metadata URL returns invalid data - hitting api/v1/fleet/sso will fail with a 500 status code, we want to return 4xx instead.

[mna]

What specific 4xx status do we want to return here? This feels wrong to me, as a 4xx code implies that the request is invalid and needs to change something to make it valid, but there's nothing the client can do to make a valid request in that scenario. It is a server error, which is 5xx - the server needs to be configured differently to succeed. I could see this being a 502 Bad Gateway error instead of 500 (https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/502), from MDN:

indicates that the server, while acting as a gateway or proxy, received an invalid response from the upstream server.

A failure to get a valid response from the IdP metadata URL does not necessarily mean the URL sends invalid data, it could be that it is temporarily down itself or the metadata server changed the location of that metadata for some reason, and if so, it requires investigation and arguably should raise an alert?

[ireedy]

Bug has aged out. Moved back to drafting

[ireedy]

Bug has aged out. Moved back to drafting