RSPEED-2466: Replace verbose rh-identity error messages with opaque responses

Error messages in rh-identity auth revealed the full expected JSON
structure of the x-rh-identity header, allowing attackers to
reconstruct the schema in ~9 iterative requests.

Replace all 11 verbose validation errors with generic responses
("Invalid identity data" / "Insufficient entitlements") and move
detailed diagnostics to logger.warning() for ops troubleshooting.

Signed-off-by: Major Hayden <major@redhat.com>

Author: major

src/authentication/rh_identity.py

@@ -54,45 +54,56 @@ def _validate_structure(self) -> None:
             "identity" not in self.identity_data
             or self.identity_data["identity"] is None
         ):
-            raise HTTPException(status_code=400, detail="Missing 'identity' field")
+            logger.warning("Identity validation failed: missing 'identity' field")
+            raise HTTPException(status_code=400, detail="Invalid identity data")
 
         identity = self.identity_data["identity"]
         if "type" not in identity:
-            raise HTTPException(status_code=400, detail="Missing identity 'type' field")
+            logger.warning("Identity validation failed: missing 'type' field")
+            raise HTTPException(status_code=400, detail="Invalid identity data")
 
         identity_type = identity["type"]
         if identity_type == "User":
             if "user" not in identity:
-                raise HTTPException(
-                    status_code=400, detail="Missing 'user' field for User type"
+                logger.warning(
+                    "Identity validation failed: missing 'user' field for User type"
                 )
+                raise HTTPException(status_code=400, detail="Invalid identity data")
             user = identity["user"]
             if "user_id" not in user:
-                raise HTTPException(
-                    status_code=400, detail="Missing 'user_id' in user data"
+                logger.warning(
+                    "Identity validation failed: missing 'user_id' in user data"
                 )
+                raise HTTPException(status_code=400, detail="Invalid identity data")
             if "username" not in user:
-                raise HTTPException(
-                    status_code=400, detail="Missing 'username' in user data"
+                logger.warning(
+                    "Identity validation failed: missing 'username' in user data"
                 )
+                raise HTTPException(status_code=400, detail="Invalid identity data")
         elif identity_type == "System":
             if "system" not in identity:
-                raise HTTPException(
-                    status_code=400, detail="Missing 'system' field for System type"
+                logger.warning(
+                    "Identity validation failed: missing 'system' field for System type"
                 )
+                raise HTTPException(status_code=400, detail="Invalid identity data")
             system = identity["system"]
             if "cn" not in system:
-                raise HTTPException(
-                    status_code=400, detail="Missing 'cn' in system data"
+                logger.warning(
+                    "Identity validation failed: missing 'cn' in system data"
                 )
+                raise HTTPException(status_code=400, detail="Invalid identity data")
             if "account_number" not in identity:
-                raise HTTPException(
-                    status_code=400, detail="Missing 'account_number' for System type"
+                logger.warning(
+                    "Identity validation failed: "
+                    "missing 'account_number' for System type"
                 )
+                raise HTTPException(status_code=400, detail="Invalid identity data")
         else:
-            raise HTTPException(
-                status_code=400, detail=f"Unsupported identity type: {identity_type}"
+            logger.warning(
+                "Identity validation failed: unsupported identity type '%s'",
+                identity_type,
             )
+            raise HTTPException(status_code=400, detail="Invalid identity data")
 
     def _get_identity_type(self) -> str:
         """Get the identity type (User or System).
@@ -169,10 +180,13 @@ def validate_entitlements(self) -> None:
 
         missing = [s for s in self.required_entitlements if not self.has_entitlement(s)]
         if missing:
-            entitlement_word = "entitlement" if len(missing) == 1 else "entitlements"
+            logger.warning(
+                "Entitlement validation failed: missing required entitlements: %s",
+                ", ".join(missing),
+            )
             raise HTTPException(
                 status_code=403,
-                detail=f"Missing required {entitlement_word}: {', '.join(missing)}",
+                detail="Insufficient entitlements",
             )
 
 

tests/unit/authentication/test_rh_identity.py

@@ -195,12 +195,12 @@ def test_has_entitlements(
             (
                 ["openshift"],
                 True,
-                "Missing required entitlement: openshift",
+                "Insufficient entitlements",
             ),  # Single missing
             (
                 ["rhel", "ansible", "openshift"],
                 True,
-                "Missing required entitlement: openshift",
+                "Insufficient entitlements",
             ),  # Multiple with one missing
         ],
     )
@@ -236,11 +236,11 @@ def test_validate_entitlements(
     @pytest.mark.parametrize(
         "missing_field,expected_error",
         [
-            ({"identity": None}, "Missing 'identity' field"),
-            ({"identity": {"org_id": "123"}}, "Missing identity 'type' field"),
+            ({"identity": None}, "Invalid identity data"),
+            ({"identity": {"org_id": "123"}}, "Invalid identity data"),
             (
                 {"identity": {"type": "User", "org_id": "123"}},
-                "Missing 'user' field for User type",
+                "Invalid identity data",
             ),
             (
                 {
@@ -250,7 +250,7 @@ def test_validate_entitlements(
                         "user": {"username": "test"},
                     }
                 },
-                "Missing 'user_id' in user data",
+                "Invalid identity data",
             ),
             (
                 {
@@ -260,15 +260,15 @@ def test_validate_entitlements(
                         "user": {"user_id": "123"},
                     }
                 },
-                "Missing 'username' in user data",
+                "Invalid identity data",
             ),
             (
                 {"identity": {"type": "System", "org_id": "123"}},
-                "Missing 'system' field for System type",
+                "Invalid identity data",
             ),
             (
                 {"identity": {"type": "System", "org_id": "123", "system": {}}},
-                "Missing 'cn' in system data",
+                "Invalid identity data",
             ),
             (
                 {
@@ -278,7 +278,7 @@ def test_validate_entitlements(
                         "system": {"cn": "test"},
                     }
                 },
-                "Missing 'account_number' for System type",
+                "Invalid identity data",
             ),
         ],
     )
@@ -300,7 +300,7 @@ def test_unsupported_identity_type(self) -> None:
             RHIdentityData(invalid_data)
 
         assert exc_info.value.status_code == 400
-        assert "Unsupported identity type: Unknown" in str(exc_info.value.detail)
+        assert "Invalid identity data" in str(exc_info.value.detail)
 
 
 class TestRHIdentityAuthDependency:
@@ -406,12 +406,12 @@ async def test_invalid_json(self) -> None:
             (
                 ["openshift"],
                 True,
-                "Missing required entitlement: openshift",
+                "Insufficient entitlements",
             ),  # Single missing
             (
                 ["rhel", "ansible", "openshift"],
                 True,
-                "Missing required entitlement: openshift",
+                "Insufficient entitlements",
             ),  # Multiple with one missing
         ],
     )