[neilLasrado]

Slice 0 of 6 toward self-hosted Google login. Merging this alone changes nothing in production — no code calls SetOIDCService yet. See the caveat at the bottom about CI.

What and why

ServerWithRoles gated four OIDC methods on the Enterprise entitlement:

if !modules.GetModules().Features().GetEntitlement(entitlements.OIDC).Enabled {
    return nil, trace.AccessDenied("OIDC is only available in Teleport Enterprise")
}

In an OSS build that entitlement is never enabled, so an OIDC connector cannot be created at all — regardless of whether an implementation exists. This gates on whether an OIDCService has actually been registered instead:

if a.authServer.oidcAuthService == nil {
    return nil, trace.AccessDenied("OIDC is not available: no OIDC service is registered")
}

This gates on capability, not licence. lib/modules and the entitlement itself are untouched, so the enterprise connector-management UI stays locked and Features() does not diverge from upstream. The alternative — shipping a fork Modules that flips the entitlement — would additionally unlock enterprise UI that has never been tested against a non-enterprise service.

lib/auth/oidc.go's own errOIDCNotImplemented is deliberately left in place. It is the layer below this one and already expresses the same "no service registered" condition.

⚠ This is not a no-op for CI

Three existing suites create OIDC connectors by enabling the entitlement via modulestest.SetTestModules and never register a service, so they regress under the new gate:

• tool/tctl/common/resource_command_test.go — TestCreateEnterpriseResources/oidc
• tool/tctl/common/edit_command_test.go — TestEditEnterpriseResources/oidc
• tool/tctl/common/admin_action_test.go — TestAdminActionMFA/OIDCConnector/* (9 subtests)

This PR fixes them by adding authtest.StubOIDCService and registering it in each fixture. Their SetTestModules setup is kept, not removed: the SAML gate still reads the entitlement directly and those subtests run off the same setup. Two independent gates, two independent setup calls.

Verification

Scoped builds only (GOFLAGS=-p=2 GOMAXPROCS=2, never ./...):

• go vet ./lib/auth/ ./lib/auth/authtest/ ./tool/tctl/common/ — clean
• TestOIDCGatedOnRegisteredService — PASS, both subtests
• TestCreateEnterpriseResources — PASS (oidc + saml)
• TestEditEnterpriseResources — PASS (oidc + saml)
• TestAdminActionMFA/OIDCConnector — PASS, all subtests

The new test was confirmed load-bearing: the gate was temporarily neutered, the "no service registered" subtest failed as expected, then reverted.

Reviewer notes

authtest.StubOIDCService lives in a non-_test.go file because it must be importable from both lib/auth's tests and tool/tctl/common's. lib/auth/authtest is test infrastructure — its only non-test importers are integration/db/fixture.go and integrations/lib/testing/integration/authhelper.go, both themselves test helpers. It does not reach the shipped binary.

🤖 Generated with Claude Code