OSAC-2982: Add client_secret_secret to IdentityProvider with dual-path reconciler

fulfillment-service/internal/cmd/service/start/grpcserver/reference_lookups.go

@@ -268,5 +268,20 @@ func registerReferenceLookups(
 	references.RegisterDAOLookup(validator, "osac.private.v1.ClusterVersionReference", clusterVersionsDAO)
 	references.RegisterDAOLookup(validator, "osac.public.v1.ClusterVersionReference", clusterVersionsDAO)
 
+	// Secret references. One registration covers every SecretLocalReference field (cluster
+	// pull_secret_secret, hub kubeconfig_secret, cluster template defaults, and identity
+	// provider client_secret_secret). Without this, the interceptor returns Internal
+	// ("no lookup registered") on Create/Update before handlers run.
+	secretsDAO, err := dao.NewGenericDAO[*privatev1.Secret]().
+		SetLogger(logger).
+		SetTenancyLogic(tenancyLogic).
+		SetMetricsRegisterer(metricsRegisterer).
+		Build()
+	if err != nil {
+		return fmt.Errorf("failed to create Secret DAO for reference lookups: %w", err)
+	}
+	references.RegisterDAOLookup(validator, "osac.private.v1.SecretLocalReference", secretsDAO)
+	references.RegisterDAOLookup(validator, "osac.public.v1.SecretLocalReference", secretsDAO)
+
 	return nil
 }

fulfillment-service/internal/cmd/service/start/grpcserver/reference_lookups_test.go

@@ -0,0 +1,167 @@
+/*
+Copyright (c) 2026 Red Hat, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the
+License. You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific
+language governing permissions and limitations under the License.
+*/
+
+package grpcserver
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"google.golang.org/grpc"
+	grpcstatus "google.golang.org/grpc/status"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+
+	privatev1 "github.com/osac-project/osac/fulfillment-service/internal/api/osac/private/v1"
+	"github.com/osac-project/osac/fulfillment-service/internal/auth"
+	"github.com/osac-project/osac/fulfillment-service/internal/references"
+)
+
+func TestRegisterReferenceLookups(t *testing.T) {
+	validator := newTestReferenceValidator(t)
+
+	t.Run("registers SecretLocalReference for private and public APIs", func(t *testing.T) {
+		for _, name := range []protoreflect.FullName{
+			"osac.private.v1.SecretLocalReference",
+			"osac.public.v1.SecretLocalReference",
+		} {
+			if !validator.HasLookup(name) {
+				t.Errorf("missing lookup for %s", name)
+			}
+		}
+	})
+
+	t.Run("registers every reference type used in Create or Update requests", func(t *testing.T) {
+		var missing []string
+		for _, name := range createOrUpdateReferenceTypes(t) {
+			if !validator.HasLookup(name) {
+				missing = append(missing, string(name))
+			}
+		}
+		slices.Sort(missing)
+		if len(missing) > 0 {
+			t.Errorf("no lookup registered for Create/Update reference types:\n  %s",
+				strings.Join(missing, "\n  "))
+		}
+	})
+
+	t.Run("interceptor does not reject identity provider client_secret_secret as unregistered", func(t *testing.T) {
+		request := privatev1.IdentityProvidersCreateRequest_builder{
+			Object: privatev1.IdentityProvider_builder{
+				Spec: privatev1.IdentityProviderSpec_builder{
+					Oidc: privatev1.OidcConfig_builder{
+						ClientSecretSecret: privatev1.SecretLocalReference_builder{
+							Id: "secret-id",
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build()
+
+		_, err := validator.UnaryServer(
+			context.Background(),
+			request,
+			&grpc.UnaryServerInfo{FullMethod: "/osac.private.v1.IdentityProviders/Create"},
+			func(context.Context, any) (any, error) { return "ok", nil },
+		)
+		if err == nil {
+			return
+		}
+		st, _ := grpcstatus.FromError(err)
+		if strings.Contains(st.Message(), "no lookup registered") {
+			t.Fatalf("SecretLocalReference is not registered with the interceptor: %v", err)
+		}
+	})
+}
+
+func newTestReferenceValidator(t *testing.T) *references.ReferenceValidator {
+	t.Helper()
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	tenancy, err := auth.NewGuestTenancyLogic().SetLogger(logger).Build()
+	if err != nil {
+		t.Fatalf("failed to create guest tenancy logic: %v", err)
+	}
+	validator, err := references.NewReferenceValidator().SetLogger(logger).Build()
+	if err != nil {
+		t.Fatalf("failed to create reference validator: %v", err)
+	}
+	if err := registerReferenceLookups(validator, logger, tenancy, prometheus.NewRegistry()); err != nil {
+		t.Fatalf("failed to register reference lookups: %v", err)
+	}
+	return validator
+}
+
+func createOrUpdateReferenceTypes(t *testing.T) []protoreflect.FullName {
+	t.Helper()
+	seen := map[protoreflect.FullName]struct{}{}
+	refs := map[protoreflect.FullName]struct{}{}
+	protoregistry.GlobalFiles.RangeFiles(func(fd protoreflect.FileDescriptor) bool {
+		pkg := string(fd.Package())
+		if pkg != "osac.private.v1" && pkg != "osac.public.v1" {
+			return true
+		}
+		services := fd.Services()
+		for i := 0; i < services.Len(); i++ {
+			methods := services.Get(i).Methods()
+			for j := 0; j < methods.Len(); j++ {
+				method := methods.Get(j)
+				name := string(method.Name())
+				if name != "Create" && name != "Update" {
+					continue
+				}
+				collectReferenceTypes(method.Input(), seen, refs)
+			}
+		}
+		return true
+	})
+	result := make([]protoreflect.FullName, 0, len(refs))
+	for name := range refs {
+		result = append(result, name)
+	}
+	slices.Sort(result)
+	return result
+}
+
+func collectReferenceTypes(
+	md protoreflect.MessageDescriptor,
+	seen map[protoreflect.FullName]struct{},
+	refs map[protoreflect.FullName]struct{},
+) {
+	if md == nil {
+		return
+	}
+	name := md.FullName()
+	if _, ok := seen[name]; ok {
+		return
+	}
+	seen[name] = struct{}{}
+
+	fields := md.Fields()
+	for i := 0; i < fields.Len(); i++ {
+		fd := fields.Get(i)
+		if fd.Kind() != protoreflect.MessageKind || fd.IsMap() {
+			continue
+		}
+		msg := fd.Message()
+		if strings.HasSuffix(string(msg.FullName()), "Reference") {
+			refs[msg.FullName()] = struct{}{}
+			continue
+		}
+		collectReferenceTypes(msg, seen, refs)
+	}
+}

fulfillment-service/internal/controllers/identityprovider/identity_provider_reconciler_function.go

@@ -80,6 +80,7 @@ func (b *FunctionBuilder) Build() (result *function, err error) {
 	result = &function{
 		logger:                  b.logger,
 		identityProvidersClient: privatev1.NewIdentityProvidersClient(b.connection),
+		secretsClient:           privatev1.NewSecretsClient(b.connection),
 		idpClient:               b.idpClient,
 		maskCalculator:          masks.NewCalculator().Build(),
 	}
@@ -90,6 +91,7 @@ func (b *FunctionBuilder) Build() (result *function, err error) {
 type function struct {
 	logger                  *slog.Logger
 	identityProvidersClient privatev1.IdentityProvidersClient
+	secretsClient           privatev1.SecretsClient
 	idpClient               idp.ClientInterface
 	maskCalculator          *masks.Calculator
 }
@@ -177,12 +179,16 @@ func (t *task) syncToIDP(ctx context.Context) error {
 	// Build the IDP provider object from the spec
 	// Use tenant-prefixed alias to ensure uniqueness across tenants in Keycloak
 	alias := fmt.Sprintf("%s-%s", fullIdp.GetMetadata().GetTenant(), fullIdp.GetMetadata().GetName())
+	clientSecret, err := t.resolveClientSecret(ctx, fullIdp)
+	if err != nil {
+		return err
+	}
 	idpProvider := &idp.IdentityProvider{
 		Alias:       alias,
 		DisplayName: fullIdp.GetSpec().GetTitle(),
 		Type:        t.determineProviderTypeFromIdp(fullIdp),
 		Enabled:     fullIdp.GetSpec().GetEnabled(),
-		Config:      t.buildConfigFromIdp(fullIdp),
+		Config:      t.buildConfigFromIdp(fullIdp, clientSecret),
 	}
 
 	tenantName := t.identityProvider.GetMetadata().GetTenant()
@@ -204,6 +210,38 @@ func (t *task) syncToIDP(ctx context.Context) error {
 	return nil
 }
 
+// resolveClientSecret returns the OIDC client secret, preferring a Secret reference over the
+// inline client_secret field. When a reference is set the secret is fetched via the Secrets API
+// using controller auth and data["value"] is extracted.
+func (t *task) resolveClientSecret(ctx context.Context, identityProvider *privatev1.IdentityProvider) (string, error) {
+	oidc := identityProvider.GetSpec().GetOidc()
+	if oidc == nil {
+		return "", nil
+	}
+	ref := oidc.GetClientSecretSecret()
+	if ref == nil {
+		return oidc.GetClientSecret(), nil
+	}
+	if t.r.secretsClient == nil {
+		return "", fmt.Errorf("secrets client is required to resolve client_secret_secret")
+	}
+	id := ref.GetId()
+	if id == "" {
+		return "", fmt.Errorf("client_secret_secret must have an id")
+	}
+	response, err := t.r.secretsClient.Get(ctx, privatev1.SecretsGetRequest_builder{
+		Id: id,
+	}.Build())
+	if err != nil {
+		return "", fmt.Errorf("failed to fetch client secret: %w", err)
+	}
+	value, ok := response.GetObject().GetData()["value"]
+	if !ok || len(value) == 0 {
+		return "", fmt.Errorf("secret %q is missing data[\"value\"]", id)
+	}
+	return string(value), nil
+}
+
 // determineProviderTypeFromIdp returns the provider type based on which config is set.
 func (t *task) determineProviderTypeFromIdp(idp *privatev1.IdentityProvider) string {
 	spec := idp.GetSpec()
@@ -214,15 +252,15 @@ func (t *task) determineProviderTypeFromIdp(idp *privatev1.IdentityProvider) str
 }
 
 // buildConfigFromIdp builds the provider-specific configuration map from any identity provider object.
-func (t *task) buildConfigFromIdp(idp *privatev1.IdentityProvider) map[string]string {
+func (t *task) buildConfigFromIdp(idp *privatev1.IdentityProvider, clientSecret string) map[string]string {
 	config := make(map[string]string)
 	spec := idp.GetSpec()
 
 	if oidc := spec.GetOidc(); oidc != nil {
 		config["authorizationUrl"] = oidc.GetAuthorizationUrl()
 		config["tokenUrl"] = oidc.GetTokenUrl()
 		config["clientId"] = oidc.GetClientId()
-		config["clientSecret"] = oidc.GetClientSecret()
+		config["clientSecret"] = clientSecret
 		config["issuer"] = oidc.GetIssuer()
 		// Keycloak requires clientAuthMethod to be set for OIDC providers
 		config["clientAuthMethod"] = "client_secret_post"