fix(iam): preserve OIDC outbound policy errors (#5762)

docs/operations/keycloak-oidc-integration.md

@@ -154,9 +154,11 @@ If RustFS reaches Keycloak through an internal URL while tokens use a public iss
 ```bash
 export RUSTFS_IDENTITY_OPENID_CONFIG_URL="http://keycloak.keycloak.svc.cluster.local:8080/realms/rustfs/.well-known/openid-configuration"
 export RUSTFS_IDENTITY_OPENID_ISSUER="https://keycloak.example.com/realms/rustfs"
+export RUSTFS_OUTBOUND_ALLOW_ORIGINS="http://keycloak.keycloak.svc.cluster.local:8080"
 ```
 
 Discovery and issuer-relative JWKS requests use the internal `CONFIG_URL` base. ID token issuer validation still uses `ISSUER`.
+The outbound allowlist entry is the exact internal origin only; do not include the realm or discovery path. RustFS reads this process setting at startup, so restart every RustFS node after changing it.
 Use HTTPS with a trusted CA for the internal URL whenever possible. Discovery and JWKS define the token-signing trust root; use HTTP only on a network where DNS and traffic cannot be tampered with, because a compromised response can authorize forged tokens.
 
 For short-lived connectivity testing only, you may temporarily add:
@@ -287,6 +289,7 @@ Expected flow:
 | Groups appear as `/consoleAdmin` | Keycloak `Full group path` is enabled | Disable `Full group path`. |
 | Console redirects to an internal host | Missing `RUSTFS_BROWSER_REDIRECT_URL` or incorrect proxy headers | Set `RUSTFS_BROWSER_REDIRECT_URL` to the public browser origin. |
 | Invalid or expired OIDC state | Callback reached a different RustFS node | Configure load-balancer session affinity for authorize and callback requests. |
+| OIDC provider or login button is missing after upgrading to beta.12+ | The internal Keycloak origin is blocked by the outbound policy | Add the exact `scheme://host:port` origin to `RUSTFS_OUTBOUND_ALLOW_ORIGINS` and restart every RustFS node. |
 
 ## 7. Production Checklist
 
@@ -299,3 +302,4 @@ Expected flow:
 - [ ] `role_policy=consoleAdmin` is not used as a permanent production shortcut.
 - [ ] The load balancer preserves query strings.
 - [ ] OIDC authorize and callback requests have session affinity to the same RustFS node.
+- [ ] Internal Keycloak origins are listed exactly in `RUSTFS_OUTBOUND_ALLOW_ORIGINS` on every RustFS node.

docs/operations/outbound-connection-policy.md

@@ -4,10 +4,11 @@ This document describes the outbound connection policy that RustFS applies to
 server-initiated HTTP(S) requests, and the `RUSTFS_OUTBOUND_ALLOW_ORIGINS`
 allowlist operators can use to reach endpoints on private or container networks.
 
-It is written for operators who upgraded to `1.0.0-beta.11` (or later) and found
-that event-notification webhooks, audit webhooks, or other outbound integrations
-stopped reaching endpoints that worked before — typically Docker Compose service
-names, `host.docker.internal`, or RFC 1918 addresses.
+It is written for operators whose outbound integrations stopped reaching
+endpoints after an upgrade — typically Docker Compose service names,
+`host.docker.internal`, or RFC 1918 addresses. Webhook and audit clients adopted
+this policy in `1.0.0-beta.11`; OIDC provider requests adopted it in
+`1.0.0-beta.12`.
 
 ## Background: what the policy protects
 
@@ -21,14 +22,16 @@ The policy governs the outbound clients used by:
 
 - event-notification webhooks (`RUSTFS_NOTIFY_WEBHOOK_*`);
 - audit webhooks (`RUSTFS_AUDIT_WEBHOOK_*`);
-- OIDC identity-provider requests;
+- OIDC identity-provider discovery, JWKS, and token requests (since `1.0.0-beta.12`);
 - S3 tiering (warm-backend) endpoints;
 - Keystone auth URLs.
 
 The webhook and audit outbound clients also **disable proxies and do not follow
 redirects**, so the destination must be reachable directly at the configured URL.
 
-## What changed in beta.11
+## What changed in beta.11 (and for OIDC in beta.12)
+
+For webhook and audit clients:
 
 | | beta.10 | beta.11+ |
 |---|---|---|
@@ -43,6 +46,11 @@ exact origin is on the allowlist. This is why a Compose setup that delivered
 events on beta.10 can go silent after the upgrade even though the configuration
 is unchanged.
 
+OIDC joined the same policy in beta.12. An internal identity provider that
+worked in beta.11 can therefore fail discovery after upgrading to beta.12 unless
+its exact origin is allowlisted. The policy remains active for discovery, JWKS,
+and token requests.
+
 ## Symptoms
 
 - Bucket event rules and webhook configuration look correct.
@@ -52,6 +60,9 @@ is unchanged.
 a loopback, private, shared, or reserved address.
 - Startup or target validation reports `webhook endpoint is not allowed: ...`
   with a reason such as `private address` or `loopback host`.
+- An OIDC provider or login button is missing, and startup reports
+  `OIDC provider discovery blocked by outbound policy` with the exact origin to
+  allowlist.
 
 ## `RUSTFS_OUTBOUND_ALLOW_ORIGINS`
 
@@ -127,7 +138,7 @@ services:
 The endpoint keeps its full path (`/events`); the allowlist entry is the origin
 (`http://logstash:8080`) only.
 
-## Upgrade checklist (beta.10 → beta.11+)
+## Upgrade checklist (beta.10 → beta.11+, or OIDC beta.11 → beta.12+)
 
 1. List every outbound endpoint whose hostname resolves to a loopback, private,
    shared, or reserved address: notification webhooks, audit webhooks, OIDC