Conditionally deny access to web console

pkg/cmd/server/origin/auth_config.go

@@ -62,7 +62,10 @@ func BuildAuthConfig(options configapi.MasterConfig) (*AuthConfig, error) {
 	// Build the list of valid redirect_uri prefixes for a login using the openshift-web-console client to redirect to
 	// TODO: allow configuring this
 	// TODO: remove hard-coding of development UI server
-	assetPublicURLs := []string{options.OAuthConfig.AssetPublicURL, "http://localhost:9000", "https://localhost:9000"}
+	assetPublicURLs := []string{}
+	if !options.DisabledFeatures.Has(configapi.FeatureWebConsole) {
+		assetPublicURLs = []string{options.OAuthConfig.AssetPublicURL, "http://localhost:9000", "https://localhost:9000"}
+	}
 
 	userStorage := useretcd.NewREST(etcdHelper)
 	userRegistry := userregistry.NewRegistry(userStorage)

pkg/cmd/server/origin/master.go

@@ -170,7 +170,7 @@ func (c *MasterConfig) Run(protected []APIInstaller, unprotected []APIInstaller)
 		handler = apiserver.CORS(handler, origins, nil, nil, "true")
 	}
 
-	if c.Options.AssetConfig != nil {
+	if c.WebConsoleEnabled() {
 		handler = assetServerRedirect(handler, c.Options.AssetConfig.PublicURL)
 	}
 

pkg/cmd/server/origin/master_config.go

@@ -428,6 +428,10 @@ func (c *MasterConfig) RouteAllocatorClients() (*osclient.Client, *kclient.Clien
 	return c.PrivilegedLoopbackOpenShiftClient, c.PrivilegedLoopbackKubernetesClient
 }
 
+func (c *MasterConfig) WebConsoleEnabled() bool {
+	return c.Options.AssetConfig != nil && !c.Options.DisabledFeatures.Has(configapi.FeatureWebConsole)
+}
+
 // OriginNamespaceControllerClients returns a client for openshift and kubernetes.
 // The openshift client object must have authority to delete openshift content in any namespace
 // The kubernetes client object must have authority to execute a finalize request on a namespace

pkg/cmd/server/start/start_master.go

@@ -358,7 +358,7 @@ func StartMaster(openshiftMasterConfig *configapi.MasterConfig) error {
 	}
 
 	var standaloneAssetConfig *origin.AssetConfig
-	if openshiftMasterConfig.AssetConfig != nil {
+	if openshiftConfig.WebConsoleEnabled() {
 		config, err := origin.BuildAssetConfig(*openshiftMasterConfig.AssetConfig)
 		if err != nil {
 			return err

test/integration/web_console_access_test.go

@@ -0,0 +1,76 @@
+// +build integration,!no-etcd
+
+package integration
+
+import (
+	"crypto/tls"
+	"net/http"
+	"testing"
+
+	configapi "github.com/openshift/origin/pkg/cmd/server/api"
+	testutil "github.com/openshift/origin/test/util"
+)
+
+var (
+	stableWebConsoleEndpoints     = []string{"healthz", "login"}
+	switchableWebConsoleEndpoints = []string{"console", "console/", "console/java"}
+)
+
+func tryAccessURL(t *testing.T, url string, expectedStatus int) {
+	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: true,
+		},
+	}
+
+	req, err := http.NewRequest("GET", url, nil)
+	req.Header.Set("Accept", "text/html")
+	resp, err := transport.RoundTrip(req)
+	if err != nil {
+		t.Errorf("Unexpected error while accessing %s: %v", url, err)
+	}
+	if resp.StatusCode != expectedStatus {
+		t.Errorf("Expected status %d for %s, got %d", expectedStatus, url, resp.StatusCode)
+	}
+}
+
+func TestAccessOriginWebConsole(t *testing.T) {
+	masterOptions, err := testutil.DefaultMasterOptions()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if _, err = testutil.StartConfiguredMaster(masterOptions); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	allEndpoints := append(stableWebConsoleEndpoints, switchableWebConsoleEndpoints...)
+	for _, endpoint := range allEndpoints {
+		url := masterOptions.AssetConfig.MasterPublicURL + "/" + endpoint
+		expectedStatus := http.StatusOK
+		if endpoint == "console" {
+			expectedStatus = http.StatusMovedPermanently
+		}
+		tryAccessURL(t, url, expectedStatus)
+	}
+}
+
+func TestAccessDisabledWebConsole(t *testing.T) {
+	masterOptions, err := testutil.DefaultMasterOptions()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	masterOptions.DisabledFeatures.Add(configapi.FeatureWebConsole)
+	if _, err := testutil.StartConfiguredMaster(masterOptions); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	for _, endpoint := range stableWebConsoleEndpoints {
+		url := masterOptions.AssetConfig.MasterPublicURL + "/" + endpoint
+		tryAccessURL(t, url, http.StatusOK)
+	}
+
+	for _, endpoint := range switchableWebConsoleEndpoints {
+		url := masterOptions.AssetConfig.MasterPublicURL + "/" + endpoint
+		tryAccessURL(t, url, http.StatusForbidden)
+	}
+}