feat(oidc): bound provider HTTP calls with an explicit timeout

The bundle never set a Guzzle timeout, so calls to the IdP (discovery,
JWKS, and especially the un-cached token exchange on the login callback)
inherited Guzzle's default of 0 — wait indefinitely. A hung or slow IdP
could therefore tie up a php-fpm worker until the FPM request terminator
kicked in.

itk-dev/openid-connect-bundle 4.2+ exposes http_client_options.timeout
(forwarded through league/oauth2-client to Guzzle), but it is opt-in with
no default. Set it on both providers via a new OIDC_HTTP_TIMEOUT env var
(default 5s), documented in .env and docs/configuration/openid-connect.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: turegjorup

.env

@@ -146,6 +146,11 @@ RELATIONS_CHECKSUM_ENABLED=true
 
 ###> itk-dev/openid-connect-bundle ###
 # See docs/feed/openid-connect.md for variable explanations.
+# Total HTTP request timeout (seconds) for calls to the OIDC providers
+# (discovery, JWKS, token exchange). Bounds a hung/slow IdP so it cannot
+# tie up a php-fpm worker indefinitely. Applies to both providers.
+OIDC_HTTP_TIMEOUT=5
+
 # internal provider (admin login)
 # URL to OIDC provider's metadata/discovery endpoint.
 INTERNAL_OIDC_METADATA_URL=INTERNAL_OIDC_METADATA_URL

CHANGELOG.md

@@ -9,6 +9,10 @@ All notable changes to this project will be documented in this file.
   `OpenIdConnectExceptionInterface` marker, since concrete exceptions no longer extend the deprecated
   `ItkOpenIdConnectException`. Added regression tests covering the exception-mapping branches and the
   authenticator's claim-to-tenant-role provisioning and de-provisioning logic.
+- Bounded OIDC provider HTTP calls (discovery, JWKS, token exchange) with an explicit
+  `http_client_options.timeout` on both providers, configurable via the new `OIDC_HTTP_TIMEOUT` env var
+  (default 5s). Previously no timeout was set anywhere in the chain, so Guzzle waited indefinitely and a
+  hung/slow IdP could tie up a php-fpm worker.
 - Removed the deprecated feed types `SparkleIOFeedType`, `EventDatabaseApiFeedType` and `KobaFeedType`.
   Made the unknown-feed-type handling consistent: **reads degrade, writes are rejected.** Feed sources
   (and feeds) that reference a removed type keep loading — item and collection reads return them with no

config/packages/itkdev_openid_connect.yaml

@@ -12,10 +12,14 @@ itkdev_openid_connect:
                 client_secret: '%env(string:INTERNAL_OIDC_CLIENT_SECRET)%'
                 redirect_uri: '%env(string:INTERNAL_OIDC_REDIRECT_URI)%'
                 leeway: '%env(int:INTERNAL_OIDC_LEEWAY)%'
+                http_client_options:
+                    timeout: '%env(float:OIDC_HTTP_TIMEOUT)%' # Bound IdP HTTP calls so a hung provider can't tie up a worker.
         external:
             options:
                 metadata_url: '%env(string:EXTERNAL_OIDC_METADATA_URL)%'
                 client_id: '%env(string:EXTERNAL_OIDC_CLIENT_ID)%'
                 client_secret: '%env(string:EXTERNAL_OIDC_CLIENT_SECRET)%'
                 redirect_uri: '%env(string:EXTERNAL_OIDC_REDIRECT_URI)%'
                 leeway: '%env(int:EXTERNAL_OIDC_LEEWAY)%'
+                http_client_options:
+                    timeout: '%env(float:OIDC_HTTP_TIMEOUT)%' # Bound IdP HTTP calls so a hung provider can't tie up a worker.

docs/configuration/openid-connect.md

@@ -2,6 +2,9 @@
 
 ```dotenv
 ###> itk-dev/openid-connect-bundle ###
+# Total HTTP request timeout (seconds) for calls to the OIDC providers.
+OIDC_HTTP_TIMEOUT=5
+
 # internal provider
 INTERNAL_OIDC_METADATA_URL=INTERNAL_OIDC_METADATA_URL
 INTERNAL_OIDC_CLIENT_ID=INTERNAL_OIDC_CLIENT_ID