Normalize OIDC issuers without trailing slash

Author: terion-labs

README.md

@@ -131,7 +131,7 @@ Top-level commands:
 | `--manage-domain` | domain | no | `manage.<domain>` when `--domain` is set, otherwise `manage.<dashed-public-ip>.traefik.me` | Overrides the Cockpit domain. |
 | `--lxd-domain` | domain | no | `lxd.<domain>` when `--domain` is set, otherwise `lxd.<dashed-public-ip>.traefik.me` | Overrides the LXD domain. |
 | `--idp` | `local` or `oidc` | yes in non-interactive mode; no in interactive mode | prompted in interactive mode | Selects whether Terrarium uses self-hosted ZITADEL (`local`) or an external OIDC issuer (`oidc`). |
-| `--oidc` | issuer URL | yes when `--idp=oidc`; no otherwise | derived from `https://<auth-domain>/` when `--idp=local` | Sets the OIDC issuer URL. |
+| `--oidc` | issuer URL | yes when `--idp=oidc`; no otherwise | derived from `https://<auth-domain>` when `--idp=local` | Sets the OIDC issuer URL. |
 | `--oidc-client` | client ID | yes when `--idp=oidc`; no otherwise | none | Sets the external OIDC client ID. |
 | `--oidc-secret` | client secret | yes when `--idp=oidc`; no otherwise | none | Sets the external OIDC client secret. |
 | `--auth-domain` | domain | no | `auth.<domain>` when `--domain` is set and self-hosted ZITADEL is enabled, otherwise `auth.<dashed-public-ip>.traefik.me` | Overrides the ZITADEL auth domain. |

ansible/site.yml

@@ -16,7 +16,7 @@
     terrarium_lxd_domain: "{{ ('lxd.' ~ terrarium_root_domain) if terrarium_root_domain else ('lxd.' ~ (terrarium_public_ip | replace('.', '-')) ~ '.traefik.me') }}"
     terrarium_idp_mode: oidc
     terrarium_auth_domain: "{{ (('auth.' ~ terrarium_root_domain) if terrarium_root_domain else ('auth.' ~ (terrarium_public_ip | replace('.', '-')) ~ '.traefik.me')) if terrarium_idp_mode == 'local' else '' }}"
-    terrarium_oidc_issuer: "{{ ('https://' ~ terrarium_auth_domain ~ '/') if terrarium_idp_mode == 'local' else '' }}"
+    terrarium_oidc_issuer: "{{ ('https://' ~ terrarium_auth_domain) if terrarium_idp_mode == 'local' else '' }}"
     terrarium_oidc_client_id: ""
     terrarium_oidc_client_secret: ""
     terrarium_zitadel_admin_email: "{{ terrarium_email }}"

scripts/terrarium-install.ts

@@ -92,7 +92,11 @@ export function normalizeOidcIssuer(value: string, fieldName: string): string {
   if (!["http:", "https:"].includes(parsed.protocol)) {
     fail(`${fieldName} must use http or https`);
   }
-  return parsed.toString().endsWith("/") ? parsed.toString() : `${parsed.toString()}/`;
+  if (parsed.pathname === "/") {
+    parsed.pathname = "";
+  }
+  const normalized = parsed.toString();
+  return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
 }
 
 function requireRoot(): void {

scripts/terrarium-zitadel-sync.ts

@@ -222,7 +222,7 @@ export async function idpSyncCmd(configPath = DEFAULT_CONFIG_PATH): Promise<void
   const outputs = readJsonFile<Record<string, { value?: string }>>(outputsPath, {});
   const lxdClientId = outputs.lxd_client_id?.value ?? "";
   if (lxdClientId && existsSync("/snap/bin/lxc")) {
-    const issuer = configString(config, "terrarium_oidc_issuer") || `https://${authDomain}/`;
+    const issuer = configString(config, "terrarium_oidc_issuer") || `https://${authDomain}`;
     await runText(["/snap/bin/lxc", "config", "set", "oidc.issuer", issuer], PREFIX);
     await runText(["/snap/bin/lxc", "config", "set", "oidc.client.id", lxdClientId], PREFIX);
   }