From 8d948b243b778378622ffa76d19b0d6eb8d76bec Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Mon, 16 Nov 2020 14:04:24 -0800
Subject: [PATCH 01/12] Implement a generic OpenIdConnect auth-provider

---
 app-config.yaml                               |  14 ++
 packages/app/src/identityProviders.ts         |   7 +
 .../core-api/src/apis/definitions/auth.ts     |  14 ++
 .../src/apis/implementations/auth/index.ts    |   1 +
 .../implementations/auth/oidc/Oidc.test.ts    | 152 ++++++++++++
 .../apis/implementations/auth/oidc/Oidc.ts    | 183 +++++++++++++++
 .../apis/implementations/auth/oidc/index.ts   |  18 ++
 .../apis/implementations/auth/oidc/types.ts   |  28 +++
 packages/core/src/api-wrappers/defaultApis.ts |  11 +
 plugins/auth-backend/package.json             |   4 +
 .../auth-backend/src/providers/factories.ts   |   2 +
 .../auth-backend/src/providers/oidc/index.ts  |  17 ++
 .../src/providers/oidc/provider.ts            | 216 ++++++++++++++++++
 plugins/auth-backend/src/service/router.ts    |   5 +-
 yarn.lock                                     |  58 ++++-
 15 files changed, 727 insertions(+), 3 deletions(-)
 create mode 100644 packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts
 create mode 100644 packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts
 create mode 100644 packages/core-api/src/apis/implementations/auth/oidc/index.ts
 create mode 100644 packages/core-api/src/apis/implementations/auth/oidc/types.ts
 create mode 100644 plugins/auth-backend/src/providers/oidc/index.ts
 create mode 100644 plugins/auth-backend/src/providers/oidc/provider.ts

diff --git a/app-config.yaml b/app-config.yaml
index 32d3470f1b..cfa47618e8 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -235,6 +235,20 @@ auth:
           $env: AUTH_OAUTH2_AUTH_URL
         tokenUrl:
           $env: AUTH_OAUTH2_TOKEN_URL
+    oidc:
+      development:
+        adUrl:
+          $env: AUTH_OIDC_AD_URL
+        clientId:
+          $env: AUTH_OIDC_CLIENT_ID
+        clientSecret:
+          $env: AUTH_OIDC_CLIENT_SECRET
+        authorizationUrl:
+          $env: AUTH_OIDC_AUTH_URL
+        tokenUrl:
+          $env: AUTH_OIDC_TOKEN_URL
+        tokenSignedResponseAlg:
+          $env: AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG
     auth0:
       development:
         clientId:
diff --git a/packages/app/src/identityProviders.ts b/packages/app/src/identityProviders.ts
index 06ff6b07d3..ba657328f2 100644
--- a/packages/app/src/identityProviders.ts
+++ b/packages/app/src/identityProviders.ts
@@ -22,9 +22,16 @@ import {
   samlAuthApiRef,
   microsoftAuthApiRef,
   oneloginAuthApiRef,
+  oidcApiRef,
 } from '@backstage/core';
 
 export const providers = [
+  {
+    id: 'oidc-auth-provider',
+    title: 'Oidc',
+    message: 'Sign In using OpenId Connect',
+    apiRef: oidcApiRef,
+  },
   {
     id: 'google-auth-provider',
     title: 'Google',
diff --git a/packages/core-api/src/apis/definitions/auth.ts b/packages/core-api/src/apis/definitions/auth.ts
index c538065f3a..5dae5532ad 100644
--- a/packages/core-api/src/apis/definitions/auth.ts
+++ b/packages/core-api/src/apis/definitions/auth.ts
@@ -311,6 +311,20 @@ export const oauth2ApiRef: ApiRef<
   description: 'Example of how to use oauth2 custom provider',
 });
 
+/**
+ * Provides authentication for custom OpenID Connect identity providers.
+ */
+export const oidcApiRef: ApiRef<
+  OAuthApi &
+    OpenIdConnectApi &
+    ProfileInfoApi &
+    BackstageIdentityApi &
+    SessionApi
+> = createApiRef({
+  id: 'core.auth.oidc',
+  description: 'Example of how to use oidc custom provider',
+});
+
 /**
  * Provides authentication for saml based identity providers
  */
diff --git a/packages/core-api/src/apis/implementations/auth/index.ts b/packages/core-api/src/apis/implementations/auth/index.ts
index 7ef78d19cf..5adfc6f621 100644
--- a/packages/core-api/src/apis/implementations/auth/index.ts
+++ b/packages/core-api/src/apis/implementations/auth/index.ts
@@ -23,3 +23,4 @@ export * from './saml';
 export * from './auth0';
 export * from './microsoft';
 export * from './onelogin';
+export * from './oidc';
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts b/packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts
new file mode 100644
index 0000000000..4286fe7e5d
--- /dev/null
+++ b/packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import OpenIdConnect from './Oidc';
+
+const theFuture = new Date(Date.now() + 3600000);
+const thePast = new Date(Date.now() - 10);
+
+const PREFIX = 'https://www.googleapis.com/auth/';
+
+const scopeTransform = (x: string[]) => x;
+
+describe('OpenIdConnect', () => {
+  it('should get refreshed access token', async () => {
+    const getSession = jest.fn().mockResolvedValue({
+      providerInfo: { accessToken: 'access-token', expiresAt: theFuture },
+    });
+    const openIdConnect = new OpenIdConnect({
+      sessionManager: { getSession } as any,
+      scopeTransform,
+    });
+
+    expect(await openIdConnect.getAccessToken('my-scope my-scope2')).toBe(
+      'access-token',
+    );
+    expect(getSession).toBeCalledTimes(1);
+    expect(getSession.mock.calls[0][0].scopes).toEqual(
+      new Set(['my-scope', 'my-scope2']),
+    );
+  });
+
+  it('should transform scopes', async () => {
+    const getSession = jest.fn().mockResolvedValue({
+      providerInfo: { accessToken: 'access-token', expiresAt: theFuture },
+    });
+    const openIdConnect = new OpenIdConnect({
+      sessionManager: { getSession } as any,
+      scopeTransform: scopes => scopes.map(scope => `my-prefix/${scope}`),
+    });
+
+    expect(await openIdConnect.getAccessToken('my-scope')).toBe('access-token');
+    expect(getSession).toBeCalledTimes(1);
+    expect(getSession.mock.calls[0][0].scopes).toEqual(
+      new Set(['my-prefix/my-scope']),
+    );
+  });
+
+  it('should get refreshed id token', async () => {
+    const getSession = jest.fn().mockResolvedValue({
+      providerInfo: { idToken: 'id-token', expiresAt: theFuture },
+    });
+    const openIdConnect = new OpenIdConnect({
+      sessionManager: { getSession } as any,
+      scopeTransform,
+    });
+
+    expect(await openIdConnect.getIdToken()).toBe('id-token');
+    expect(getSession).toBeCalledTimes(1);
+  });
+
+  it('should get optional id token', async () => {
+    const getSession = jest.fn().mockResolvedValue({
+      providerInfo: { idToken: 'id-token', expiresAt: theFuture },
+    });
+    const openIdConnect = new OpenIdConnect({
+      sessionManager: { getSession } as any,
+      scopeTransform,
+    });
+
+    expect(await openIdConnect.getIdToken({ optional: true })).toBe('id-token');
+    expect(getSession).toBeCalledTimes(1);
+  });
+
+  it('should share popup closed errors', async () => {
+    const error = new Error('NOPE');
+    error.name = 'RejectedError';
+    const getSession = jest
+      .fn()
+      .mockResolvedValueOnce({
+        providerInfo: {
+          accessToken: 'access-token',
+          expiresAt: theFuture,
+          scopes: new Set([`${PREFIX}not-enough`]),
+        },
+      })
+      .mockRejectedValue(error);
+    const openIdConnect = new OpenIdConnect({
+      sessionManager: { getSession } as any,
+      scopeTransform,
+    });
+
+    // Make sure we have a session before we do the double request, so that we get past the !this.currentSession check
+    await expect(openIdConnect.getAccessToken()).resolves.toBe('access-token');
+
+    const promise1 = openIdConnect.getAccessToken('more');
+    const promise2 = openIdConnect.getAccessToken('more');
+    await expect(promise1).rejects.toBe(error);
+    await expect(promise2).rejects.toBe(error);
+    expect(getSession).toBeCalledTimes(3);
+  });
+
+  it('should wait for all session refreshes', async () => {
+    const initialSession = {
+      providerInfo: {
+        idToken: 'token1',
+        expiresAt: theFuture,
+        scopes: new Set(),
+      },
+    };
+    const getSession = jest
+      .fn()
+      .mockResolvedValueOnce(initialSession)
+      .mockResolvedValue({
+        providerInfo: {
+          idToken: 'token2',
+          expiresAt: theFuture,
+          scopes: new Set(),
+        },
+      });
+    const openIdConnect = new OpenIdConnect({
+      sessionManager: { getSession } as any,
+      scopeTransform,
+    });
+
+    // Grab the expired session first
+    await expect(openIdConnect.getIdToken()).resolves.toBe('token1');
+    expect(getSession).toBeCalledTimes(1);
+
+    initialSession.providerInfo.expiresAt = thePast;
+
+    const promise1 = openIdConnect.getIdToken();
+    const promise2 = openIdConnect.getIdToken();
+    const promise3 = openIdConnect.getIdToken();
+    await expect(promise1).resolves.toBe('token2');
+    await expect(promise2).resolves.toBe('token2');
+    await expect(promise3).resolves.toBe('token2');
+    expect(getSession).toBeCalledTimes(4); // De-duping of session requests happens in client
+  });
+});
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts b/packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts
new file mode 100644
index 0000000000..deb8331432
--- /dev/null
+++ b/packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts
@@ -0,0 +1,183 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import OpenIdConnectIcon from '@material-ui/icons/AcUnit';
+import { DefaultAuthConnector } from '../../../../lib/AuthConnector';
+import { RefreshingAuthSessionManager } from '../../../../lib/AuthSessionManager';
+import { SessionManager } from '../../../../lib/AuthSessionManager/types';
+import { Observable } from '../../../../types';
+import {
+  AuthRequestOptions,
+  BackstageIdentity,
+  OAuthApi,
+  OpenIdConnectApi,
+  ProfileInfo,
+  ProfileInfoApi,
+  SessionState,
+  SessionApi,
+  BackstageIdentityApi,
+} from '../../../definitions/auth';
+import { OpenIdConnectSession } from './types';
+import { OAuthApiCreateOptions } from '../types';
+
+type Options = {
+  sessionManager: SessionManager<OpenIdConnectSession>;
+  scopeTransform: (scopes: string[]) => string[];
+};
+
+type CreateOptions = OAuthApiCreateOptions & {
+  scopeTransform?: (scopes: string[]) => string[];
+};
+
+export type OpenIdConnectResponse = {
+  providerInfo: {
+    accessToken: string;
+    idToken: string;
+    scope: string;
+    expiresInSeconds: number;
+  };
+  profile: ProfileInfo;
+  backstageIdentity: BackstageIdentity;
+};
+
+const DEFAULT_PROVIDER = {
+  id: 'oidc',
+  title: 'Open ID Connect Identity Provider',
+  icon: OpenIdConnectIcon,
+};
+
+class OpenIdConnect
+  implements
+    OAuthApi,
+    OpenIdConnectApi,
+    ProfileInfoApi,
+    BackstageIdentityApi,
+    SessionApi {
+  static create({
+    discoveryApi,
+    environment = 'development',
+    provider = DEFAULT_PROVIDER,
+    oauthRequestApi,
+    defaultScopes = [],
+    scopeTransform = x => x,
+  }: CreateOptions) {
+    const connector = new DefaultAuthConnector({
+      discoveryApi,
+      environment,
+      provider,
+      oauthRequestApi: oauthRequestApi,
+      sessionTransform(res: OpenIdConnectResponse): OpenIdConnectSession {
+        return {
+          ...res,
+          providerInfo: {
+            idToken: res.providerInfo.idToken,
+            accessToken: res.providerInfo.accessToken,
+            scopes: OpenIdConnect.normalizeScopes(
+              scopeTransform,
+              res.providerInfo.scope,
+            ),
+            expiresAt: new Date(
+              Date.now() + res.providerInfo.expiresInSeconds * 1000,
+            ),
+          },
+        };
+      },
+    });
+
+    const sessionManager = new RefreshingAuthSessionManager({
+      connector,
+      defaultScopes: new Set(defaultScopes),
+      sessionScopes: (session: OpenIdConnectSession) =>
+        session.providerInfo.scopes,
+      sessionShouldRefresh: (session: OpenIdConnectSession) => {
+        const expiresInSec =
+          (session.providerInfo.expiresAt.getTime() - Date.now()) / 1000;
+        return expiresInSec < 60 * 5;
+      },
+    });
+
+    return new OpenIdConnect({ sessionManager, scopeTransform });
+  }
+
+  private readonly sessionManager: SessionManager<OpenIdConnectSession>;
+  private readonly scopeTransform: (scopes: string[]) => string[];
+
+  constructor(options: Options) {
+    this.sessionManager = options.sessionManager;
+    this.scopeTransform = options.scopeTransform;
+  }
+
+  async signIn() {
+    await this.getAccessToken();
+  }
+
+  async signOut() {
+    await this.sessionManager.removeSession();
+  }
+
+  sessionState$(): Observable<SessionState> {
+    return this.sessionManager.sessionState$();
+  }
+
+  async getAccessToken(
+    scope?: string | string[],
+    options?: AuthRequestOptions,
+  ) {
+    const normalizedScopes = OpenIdConnect.normalizeScopes(
+      this.scopeTransform,
+      scope,
+    );
+    const session = await this.sessionManager.getSession({
+      ...options,
+      scopes: normalizedScopes,
+    });
+    return session?.providerInfo.accessToken ?? '';
+  }
+
+  async getIdToken(options: AuthRequestOptions = {}) {
+    const session = await this.sessionManager.getSession(options);
+    return session?.providerInfo.idToken ?? '';
+  }
+
+  async getBackstageIdentity(
+    options: AuthRequestOptions = {},
+  ): Promise<BackstageIdentity | undefined> {
+    const session = await this.sessionManager.getSession(options);
+    return session?.backstageIdentity;
+  }
+
+  async getProfile(options: AuthRequestOptions = {}) {
+    const session = await this.sessionManager.getSession(options);
+    return session?.profile;
+  }
+
+  private static normalizeScopes(
+    scopeTransform: (scopes: string[]) => string[],
+    scopes?: string | string[],
+  ): Set<string> {
+    if (!scopes) {
+      return new Set();
+    }
+
+    const scopeList = Array.isArray(scopes)
+      ? scopes
+      : scopes.split(/[\s|,]/).filter(Boolean);
+
+    return new Set(scopeTransform(scopeList));
+  }
+}
+
+export default OpenIdConnect;
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/index.ts b/packages/core-api/src/apis/implementations/auth/oidc/index.ts
new file mode 100644
index 0000000000..cf9add0757
--- /dev/null
+++ b/packages/core-api/src/apis/implementations/auth/oidc/index.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { default as OpenIdConnect } from './Oidc';
+export * from './types';
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/types.ts b/packages/core-api/src/apis/implementations/auth/oidc/types.ts
new file mode 100644
index 0000000000..ae9696c229
--- /dev/null
+++ b/packages/core-api/src/apis/implementations/auth/oidc/types.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ProfileInfo, BackstageIdentity } from '../../../definitions';
+
+export type OpenIdConnectSession = {
+  providerInfo: {
+    idToken: string;
+    accessToken: string;
+    scopes: Set<string>;
+    expiresAt: Date;
+  };
+  profile: ProfileInfo;
+  backstageIdentity: BackstageIdentity;
+};
diff --git a/packages/core/src/api-wrappers/defaultApis.ts b/packages/core/src/api-wrappers/defaultApis.ts
index 61d4f3a7e1..adc5fce30a 100644
--- a/packages/core/src/api-wrappers/defaultApis.ts
+++ b/packages/core/src/api-wrappers/defaultApis.ts
@@ -46,6 +46,8 @@ import {
   SamlAuth,
   oneloginAuthApiRef,
   OneLoginAuth,
+  oidcApiRef,
+  OpenIdConnect,
 } from '@backstage/core-api';
 
 export const defaultApis = [
@@ -153,4 +155,13 @@ export const defaultApis = [
     factory: ({ discoveryApi, oauthRequestApi }) =>
       OneLoginAuth.create({ discoveryApi, oauthRequestApi }),
   }),
+  createApiFactory({
+    api: oidcApiRef,
+    deps: {
+      discoveryApi: discoveryApiRef,
+      oauthRequestApi: oauthRequestApiRef,
+    },
+    factory: ({ discoveryApi, oauthRequestApi }) =>
+      OpenIdConnect.create({ discoveryApi, oauthRequestApi }),
+  }),
 ];
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 8ce955350a..d28251badf 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -25,12 +25,15 @@
     "@backstage/catalog-model": "^0.2.0",
     "@backstage/config": "^0.1.1",
     "@types/express": "^4.17.6",
+    "@types/express-session": "^1.17.2",
+    "@types/openid-client": "^3.7.0",
     "compression": "^1.7.4",
     "cookie-parser": "^1.4.5",
     "cors": "^2.8.5",
     "cross-fetch": "^3.0.6",
     "express": "^4.17.1",
     "express-promise-router": "^3.0.3",
+    "express-session": "^1.17.1",
     "fs-extra": "^9.0.0",
     "got": "^11.5.2",
     "helmet": "^4.0.0",
@@ -39,6 +42,7 @@
     "knex": "^0.21.6",
     "moment": "^2.26.0",
     "morgan": "^1.10.0",
+    "openid-client": "^4.2.1",
     "passport": "^0.4.1",
     "passport-github2": "^0.1.12",
     "passport-gitlab2": "^5.0.0",
diff --git a/plugins/auth-backend/src/providers/factories.ts b/plugins/auth-backend/src/providers/factories.ts
index a764d0b50e..d4a29c0959 100644
--- a/plugins/auth-backend/src/providers/factories.ts
+++ b/plugins/auth-backend/src/providers/factories.ts
@@ -18,6 +18,7 @@ import { createGithubProvider } from './github';
 import { createGitlabProvider } from './gitlab';
 import { createGoogleProvider } from './google';
 import { createOAuth2Provider } from './oauth2';
+import { createOidcProvider } from './oidc';
 import { createOktaProvider } from './okta';
 import { createSamlProvider } from './saml';
 import { createAuth0Provider } from './auth0';
@@ -34,6 +35,7 @@ const factories: { [providerId: string]: AuthProviderFactory } = {
   auth0: createAuth0Provider,
   microsoft: createMicrosoftProvider,
   oauth2: createOAuth2Provider,
+  oidc: createOidcProvider,
   onelogin: createOneLoginProvider,
 };
 
diff --git a/plugins/auth-backend/src/providers/oidc/index.ts b/plugins/auth-backend/src/providers/oidc/index.ts
new file mode 100644
index 0000000000..acacbde73d
--- /dev/null
+++ b/plugins/auth-backend/src/providers/oidc/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { createOidcProvider } from './provider';
diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
new file mode 100644
index 0000000000..3217c2a537
--- /dev/null
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -0,0 +1,216 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import express from 'express';
+import {
+  Issuer,
+  Client,
+  Strategy as OidcStrategy,
+  TokenSet,
+  UserinfoResponse,
+} from 'openid-client';
+import {
+  OAuthAdapter,
+  OAuthProviderOptions,
+  OAuthHandlers,
+  OAuthResponse,
+  OAuthEnvironmentHandler,
+  OAuthStartRequest,
+  encodeState,
+  OAuthRefreshRequest,
+} from '../../lib/oauth';
+import {
+  executeFetchUserProfileStrategy,
+  executeFrameHandlerStrategy,
+  executeRedirectStrategy,
+  executeRefreshTokenStrategy,
+  PassportDoneCallback,
+} from '../../lib/passport';
+import { RedirectInfo, AuthProviderFactory, ProfileInfo } from '../types';
+
+type PrivateInfo = {
+  refreshToken: string;
+};
+
+export type OidcAuthProviderOptions = OAuthProviderOptions & {
+  authorizationUrl: string;
+  tokenUrl: string;
+  adUrl: string;
+  tokenSignedResponseAlg?: string;
+};
+
+export class OidcAuthProvider implements OAuthHandlers {
+  private readonly _strategy: Promise<OidcStrategy<UserinfoResponse, Client>>;
+
+  constructor(options: OidcAuthProviderOptions) {
+    this._strategy = this.setupStrategy(options);
+  }
+
+  async start(req: OAuthStartRequest): Promise<RedirectInfo> {
+    const strategy = await this._strategy;
+    return await executeRedirectStrategy(req, strategy, {
+      accessType: 'offline',
+      prompt: 'consent',
+      scope: `${req.scope} default`,
+      state: encodeState(req.state),
+    });
+  }
+
+  async handler(
+    req: express.Request,
+  ): Promise<{ response: OAuthResponse; refreshToken: string }> {
+    const strategy = await this._strategy;
+    const { response, privateInfo } = await executeFrameHandlerStrategy<
+      OAuthResponse,
+      PrivateInfo
+    >(req, strategy);
+
+    return {
+      response: await this.populateIdentity(response),
+      refreshToken: privateInfo.refreshToken,
+    };
+  }
+
+  async refresh(req: OAuthRefreshRequest): Promise<OAuthResponse> {
+    const strategy = await this._strategy;
+    const refreshTokenResponse = await executeRefreshTokenStrategy(
+      strategy,
+      req.refreshToken,
+      req.scope,
+    );
+    const {
+      accessToken,
+      params,
+      refreshToken: updatedRefreshToken,
+    } = refreshTokenResponse;
+
+    const profile = await executeFetchUserProfileStrategy(
+      strategy,
+      accessToken,
+      params.id_token,
+    );
+
+    return this.populateIdentity({
+      providerInfo: {
+        accessToken,
+        refreshToken: updatedRefreshToken,
+        idToken: params.id_token,
+        expiresInSeconds: params.expires_in,
+        scope: params.scope,
+      },
+      profile,
+    });
+  }
+
+  private async setupStrategy(
+    options: OidcAuthProviderOptions,
+  ): Promise<OidcStrategy<UserinfoResponse, Client>> {
+    const issuer = await Issuer.discover(options.adUrl);
+    // console.log('Discovered issuer %s %O', issuer.issuer, issuer.metadata);
+    const client = new issuer.Client({
+      client_id: options.clientId,
+      client_secret: options.clientSecret,
+      redirect_uris: [options.callbackUrl],
+      response_types: ['code'],
+      id_token_signed_response_alg: options.tokenSignedResponseAlg || 'RS256',
+    });
+
+    const strategy = new OidcStrategy(
+      {
+        client,
+        passReqToCallback: false as true,
+      },
+      (
+        tokenset: TokenSet,
+        userinfo: UserinfoResponse,
+        done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
+      ) => {
+        const profile: ProfileInfo = {
+          displayName: userinfo.name,
+          email: userinfo.email,
+          picture: userinfo.picture,
+        };
+
+        done(
+          undefined,
+          {
+            providerInfo: {
+              idToken: tokenset.id_token || '',
+              accessToken: tokenset.access_token || '',
+              scope: tokenset.scope || '',
+              expiresInSeconds: tokenset.expires_in,
+            },
+            profile,
+          },
+          {
+            refreshToken: tokenset.refresh_token || '',
+          },
+        );
+      },
+    );
+    strategy.error = console.error;
+    return strategy;
+  }
+
+  // Use this function to grab the user profile info from the token
+  // Then populate the profile with it
+  private async populateIdentity(
+    response: OAuthResponse,
+  ): Promise<OAuthResponse> {
+    const { profile } = response;
+
+    if (!profile.email) {
+      throw new Error('Profile does not contain an email');
+    }
+    const id = profile.email.split('@')[0];
+
+    return { ...response, backstageIdentity: { id } };
+  }
+}
+
+export const createOidcProvider: AuthProviderFactory = ({
+  globalConfig,
+  config,
+  tokenIssuer,
+}) =>
+  OAuthEnvironmentHandler.mapConfig(config, envConfig => {
+    const providerId = 'oidc';
+    const clientId = envConfig.getString('clientId');
+    const clientSecret = envConfig.getString('clientSecret');
+    const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+    const authorizationUrl = envConfig.getString('authorizationUrl');
+    const adUrl = envConfig.getString('adUrl');
+    const tokenUrl = envConfig.getString('tokenUrl');
+    const tokenSignedResponseAlg = envConfig.getString(
+      'tokenSignedResponseAlg',
+    );
+
+    const provider = new OidcAuthProvider({
+      clientId,
+      clientSecret,
+      callbackUrl,
+      authorizationUrl,
+      tokenUrl,
+      tokenSignedResponseAlg,
+      adUrl,
+    });
+
+    return OAuthAdapter.fromConfig(globalConfig, provider, {
+      disableRefresh: false,
+      providerId,
+      tokenIssuer,
+    });
+  });
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 0d19e67fc4..b74f7d8d38 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -27,6 +27,7 @@ import Router from 'express-promise-router';
 import { Logger } from 'winston';
 import { createOidcRouter, DatabaseKeyStore, TokenFactory } from '../identity';
 import { createAuthProvider } from '../providers';
+import session from 'express-session';
 
 export interface RouterOptions {
   logger: Logger;
@@ -59,7 +60,9 @@ export async function createRouter({
   });
   const catalogApi = new CatalogClient({ discoveryApi: discovery });
 
-  router.use(cookieParser());
+  const secret = 'backstage secret'; // TODO: Allow an override here
+  router.use(cookieParser(secret));
+  router.use(session({ secret }));
   router.use(express.urlencoded({ extended: false }));
   router.use(express.json());
 
diff --git a/yarn.lock b/yarn.lock
index bd1757cea0..2c4d23e8d7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5138,6 +5138,13 @@
     "@types/qs" "*"
     "@types/range-parser" "*"
 
+"@types/express-session@^1.17.2":
+  version "1.17.2"
+  resolved "https://registry.npmjs.org/@types/express-session/-/express-session-1.17.2.tgz#ed6a36dd9f267c7fef86004f653bfb9b5cea3c21"
+  integrity sha512-QRm/fUuvr/BAosL9CvK351SDQP7wpD8+h3S8ZEE/8IvHJ/ZqHrjZbjx/flYfazyPw7yNi9O5fbjFZbh0vZ1ccg==
+  dependencies:
+    "@types/express" "*"
+
 "@types/express@*", "@types/express@4.17.7", "@types/express@^4.17.6", "@types/express@^4.17.7":
   version "4.17.7"
   resolved "https://registry.npmjs.org/@types/express/-/express-4.17.7.tgz#42045be6475636d9801369cd4418ef65cdb0dd59"
@@ -5566,6 +5573,13 @@
   dependencies:
     "@types/node" "*"
 
+"@types/openid-client@^3.7.0":
+  version "3.7.0"
+  resolved "https://registry.npmjs.org/@types/openid-client/-/openid-client-3.7.0.tgz#8406e12798d16083df09cc3625973f5a00dd57fa"
+  integrity sha512-hW+QbAeUyfUHABwUjUECOcv56Mf5tN29xK3GPN7wy3R3XfIQdkm37XELA4wbe2RNG9GYUpN8l2ytfoW05XmpgQ==
+  dependencies:
+    openid-client "*"
+
 "@types/ora@^3.2.0":
   version "3.2.0"
   resolved "https://registry.npmjs.org/@types/ora/-/ora-3.2.0.tgz#b2f65d1283a8f36d8b0f9ee767e0732a2f429362"
@@ -11564,6 +11578,20 @@ express-promise-router@^3.0.3:
     lodash.flattendeep "^4.0.0"
     methods "^1.0.0"
 
+express-session@^1.17.1:
+  version "1.17.1"
+  resolved "https://registry.npmjs.org/express-session/-/express-session-1.17.1.tgz#36ecbc7034566d38c8509885c044d461c11bf357"
+  integrity sha512-UbHwgqjxQZJiWRTMyhvWGvjBQduGCSBDhhZXYenziMFjxst5rMV+aJZ6hKPHZnPyHGsrqRICxtX8jtEbm/z36Q==
+  dependencies:
+    cookie "0.4.0"
+    cookie-signature "1.0.6"
+    debug "2.6.9"
+    depd "~2.0.0"
+    on-headers "~1.0.2"
+    parseurl "~1.3.3"
+    safe-buffer "5.2.0"
+    uid-safe "~2.1.5"
+
 express@^4.0.0, express@^4.17.0, express@^4.17.1:
   version "4.17.1"
   resolved "https://registry.npmjs.org/express/-/express-4.17.1.tgz#4491fc38605cf51f8629d39c2b5d026f98a4c134"
@@ -12792,7 +12820,7 @@ got@^11.6.2:
     p-cancelable "^2.0.0"
     responselike "^2.0.0"
 
-got@^11.7.0:
+got@^11.7.0, got@^11.8.0:
   version "11.8.0"
   resolved "https://registry.npmjs.org/got/-/got-11.8.0.tgz#be0920c3586b07fd94add3b5b27cb28f49e6545f"
   integrity sha512-k9noyoIIY9EejuhaBNLyZ31D5328LeqnyPNXJQb2XlJZcKakLqN5m6O/ikhq/0lw56kUYS54fVm+D1x57YC9oQ==
@@ -17740,6 +17768,20 @@ opencollective-postinstall@^2.0.2:
   resolved "https://registry.npmjs.org/opencollective-postinstall/-/opencollective-postinstall-2.0.2.tgz#5657f1bede69b6e33a45939b061eb53d3c6c3a89"
   integrity sha512-pVOEP16TrAO2/fjej1IdOyupJY8KDUM1CvsaScRbw6oddvpQoOfGk4ywha0HKKVAD6RkW4x6Q+tNBwhf3Bgpuw==
 
+openid-client@*, openid-client@^4.2.1:
+  version "4.2.1"
+  resolved "https://registry.npmjs.org/openid-client/-/openid-client-4.2.1.tgz#8200c0ab6a3b8e954727dfa790847dc5cb8999c2"
+  integrity sha512-07eOcJeMH3ZHNvx5DVMZQmy3vZSTQqKSSunbtM1pXb+k5LBPi5hMum1vJCFReXlo4wuLEqZ/OgbsZvXPhbGRtA==
+  dependencies:
+    base64url "^3.0.1"
+    got "^11.8.0"
+    jose "^2.0.2"
+    lru-cache "^6.0.0"
+    make-error "^1.3.6"
+    object-hash "^2.0.1"
+    oidc-token-hash "^5.0.0"
+    p-any "^3.0.0"
+
 openid-client@^4.1.1:
   version "4.1.1"
   resolved "https://registry.npmjs.org/openid-client/-/openid-client-4.1.1.tgz#3e8a25584c4292e9b9b03e60358f5549fb85197a"
@@ -19573,6 +19615,11 @@ ramda@^0.26, ramda@~0.26.1:
   resolved "https://registry.npmjs.org/ramda/-/ramda-0.26.1.tgz#8d41351eb8111c55353617fc3bbffad8e4d35d06"
   integrity sha512-hLWjpy7EnsDBb0p+Z3B7rPi3GDeRG5ZtiI33kJhTt+ORCd38AbAIjB/9zRIUoeTbE/AVX5ZkU7m6bznsvrf8eQ==
 
+random-bytes@~1.0.0:
+  version "1.0.0"
+  resolved "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz#4f68a1dc0ae58bd3fb95848c30324db75d64360b"
+  integrity sha1-T2ih3Arli9P7lYSMMDJNt11kNgs=
+
 randombytes@^2.0.0, randombytes@^2.0.1, randombytes@^2.0.5, randombytes@^2.1.0:
   version "2.1.0"
   resolved "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz#df6f84372f0270dc65cdf6291349ab7a473d4f2a"
@@ -21086,7 +21133,7 @@ safe-buffer@5.1.2, safe-buffer@~5.1.0, safe-buffer@~5.1.1:
   resolved "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz#991ec69d296e0313747d59bdfd2b745c35f8828d"
   integrity sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==
 
-safe-buffer@>=5.1.0, safe-buffer@^5.0.1, safe-buffer@^5.1.0, safe-buffer@^5.1.1, safe-buffer@^5.1.2, safe-buffer@^5.2.0, safe-buffer@~5.2.0:
+safe-buffer@5.2.0, safe-buffer@>=5.1.0, safe-buffer@^5.0.1, safe-buffer@^5.1.0, safe-buffer@^5.1.1, safe-buffer@^5.1.2, safe-buffer@^5.2.0, safe-buffer@~5.2.0:
   version "5.2.0"
   resolved "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz#b74daec49b1148f88c64b68d49b1e815c1f2f519"
   integrity sha512-fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==
@@ -23357,6 +23404,13 @@ uid-number@0.0.6:
   resolved "https://registry.npmjs.org/uid-number/-/uid-number-0.0.6.tgz#0ea10e8035e8eb5b8e4449f06da1c730663baa81"
   integrity sha1-DqEOgDXo61uOREnwbaHHMGY7qoE=
 
+uid-safe@~2.1.5:
+  version "2.1.5"
+  resolved "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.5.tgz#2b3d5c7240e8fc2e58f8aa269e5ee49c0857bd3a"
+  integrity sha512-KPHm4VL5dDXKz01UuEd88Df+KzynaohSL9fBh096KWAxSKZQDI2uBrVqtvRM4rwrIrRRKsdLNML/lnaaVSRioA==
+  dependencies:
+    random-bytes "~1.0.0"
+
 uid2@0.0.3, uid2@0.0.x:
   version "0.0.3"
   resolved "https://registry.npmjs.org/uid2/-/uid2-0.0.3.tgz#483126e11774df2f71b8b639dcd799c376162b82"

From 563533dc6c13b35c3e46f3ec6ee5f284e18f4ce5 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Mon, 16 Nov 2020 16:13:01 -0800
Subject: [PATCH 02/12] Moved @types deps to devDependencies

---
 plugins/auth-backend/package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index d28251badf..f1ad45d9e5 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -25,8 +25,6 @@
     "@backstage/catalog-model": "^0.2.0",
     "@backstage/config": "^0.1.1",
     "@types/express": "^4.17.6",
-    "@types/express-session": "^1.17.2",
-    "@types/openid-client": "^3.7.0",
     "compression": "^1.7.4",
     "cookie-parser": "^1.4.5",
     "cors": "^2.8.5",
@@ -60,7 +58,9 @@
     "@backstage/cli": "^0.3.0",
     "@types/body-parser": "^1.19.0",
     "@types/cookie-parser": "^1.4.2",
+    "@types/express-session": "^1.17.2",
     "@types/jwt-decode": "2.2.1",
+    "@types/openid-client": "^3.7.0",
     "@types/passport": "^1.0.3",
     "@types/passport-github2": "^1.2.4",
     "@types/passport-google-oauth20": "^2.0.3",

From 5d27349000cb702b81258a5a551533798b99daca Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Mon, 16 Nov 2020 16:13:33 -0800
Subject: [PATCH 03/12] Initialized saveUninitialized in express-session

---
 plugins/auth-backend/src/service/router.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index b74f7d8d38..3ae3b6cb95 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -62,7 +62,7 @@ export async function createRouter({
 
   const secret = 'backstage secret'; // TODO: Allow an override here
   router.use(cookieParser(secret));
-  router.use(session({ secret }));
+  router.use(session({ secret, saveUninitialized: false }));
   router.use(express.urlencoded({ extended: false }));
   router.use(express.json());
 

From b5bb6935223a93bac93158d09a034304d065bca2 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Mon, 16 Nov 2020 17:13:19 -0800
Subject: [PATCH 04/12] Initialized resave in express-session

---
 plugins/auth-backend/src/service/router.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 3ae3b6cb95..e8624d36b3 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -62,7 +62,7 @@ export async function createRouter({
 
   const secret = 'backstage secret'; // TODO: Allow an override here
   router.use(cookieParser(secret));
-  router.use(session({ secret, saveUninitialized: false }));
+  router.use(session({ secret, saveUninitialized: false, resave: false }));
   router.use(express.urlencoded({ extended: false }));
   router.use(express.json());
 

From 14faf3ad37caa68115f6101f69c6d86b9107bcf6 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Wed, 18 Nov 2020 12:55:11 -0800
Subject: [PATCH 05/12] Changed the oidc prompt parameter value to "none"

---
 plugins/auth-backend/src/providers/oidc/provider.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
index 3217c2a537..ed1488851e 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -63,7 +63,7 @@ export class OidcAuthProvider implements OAuthHandlers {
     const strategy = await this._strategy;
     return await executeRedirectStrategy(req, strategy, {
       accessType: 'offline',
-      prompt: 'consent',
+      prompt: 'none',
       scope: `${req.scope} default`,
       state: encodeState(req.state),
     });

From 52e79a003238ffd0a7950b89a765787687ffbc53 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Wed, 18 Nov 2020 18:23:59 -0800
Subject: [PATCH 06/12] Addressed PR feedback from @Rugvip

---
 .../src/apis/implementations/auth/index.ts    |   1 -
 .../implementations/auth/oidc/Oidc.test.ts    | 152 ---------------
 .../apis/implementations/auth/oidc/Oidc.ts    | 183 ------------------
 .../apis/implementations/auth/oidc/index.ts   |  18 --
 .../apis/implementations/auth/oidc/types.ts   |  28 ---
 packages/core/src/api-wrappers/defaultApis.ts |   3 +-
 .../src/providers/oidc/provider.ts            |  15 +-
 7 files changed, 5 insertions(+), 395 deletions(-)
 delete mode 100644 packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts
 delete mode 100644 packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts
 delete mode 100644 packages/core-api/src/apis/implementations/auth/oidc/index.ts
 delete mode 100644 packages/core-api/src/apis/implementations/auth/oidc/types.ts

diff --git a/packages/core-api/src/apis/implementations/auth/index.ts b/packages/core-api/src/apis/implementations/auth/index.ts
index 5adfc6f621..7ef78d19cf 100644
--- a/packages/core-api/src/apis/implementations/auth/index.ts
+++ b/packages/core-api/src/apis/implementations/auth/index.ts
@@ -23,4 +23,3 @@ export * from './saml';
 export * from './auth0';
 export * from './microsoft';
 export * from './onelogin';
-export * from './oidc';
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts b/packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts
deleted file mode 100644
index 4286fe7e5d..0000000000
--- a/packages/core-api/src/apis/implementations/auth/oidc/Oidc.test.ts
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright 2020 Spotify AB
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import OpenIdConnect from './Oidc';
-
-const theFuture = new Date(Date.now() + 3600000);
-const thePast = new Date(Date.now() - 10);
-
-const PREFIX = 'https://www.googleapis.com/auth/';
-
-const scopeTransform = (x: string[]) => x;
-
-describe('OpenIdConnect', () => {
-  it('should get refreshed access token', async () => {
-    const getSession = jest.fn().mockResolvedValue({
-      providerInfo: { accessToken: 'access-token', expiresAt: theFuture },
-    });
-    const openIdConnect = new OpenIdConnect({
-      sessionManager: { getSession } as any,
-      scopeTransform,
-    });
-
-    expect(await openIdConnect.getAccessToken('my-scope my-scope2')).toBe(
-      'access-token',
-    );
-    expect(getSession).toBeCalledTimes(1);
-    expect(getSession.mock.calls[0][0].scopes).toEqual(
-      new Set(['my-scope', 'my-scope2']),
-    );
-  });
-
-  it('should transform scopes', async () => {
-    const getSession = jest.fn().mockResolvedValue({
-      providerInfo: { accessToken: 'access-token', expiresAt: theFuture },
-    });
-    const openIdConnect = new OpenIdConnect({
-      sessionManager: { getSession } as any,
-      scopeTransform: scopes => scopes.map(scope => `my-prefix/${scope}`),
-    });
-
-    expect(await openIdConnect.getAccessToken('my-scope')).toBe('access-token');
-    expect(getSession).toBeCalledTimes(1);
-    expect(getSession.mock.calls[0][0].scopes).toEqual(
-      new Set(['my-prefix/my-scope']),
-    );
-  });
-
-  it('should get refreshed id token', async () => {
-    const getSession = jest.fn().mockResolvedValue({
-      providerInfo: { idToken: 'id-token', expiresAt: theFuture },
-    });
-    const openIdConnect = new OpenIdConnect({
-      sessionManager: { getSession } as any,
-      scopeTransform,
-    });
-
-    expect(await openIdConnect.getIdToken()).toBe('id-token');
-    expect(getSession).toBeCalledTimes(1);
-  });
-
-  it('should get optional id token', async () => {
-    const getSession = jest.fn().mockResolvedValue({
-      providerInfo: { idToken: 'id-token', expiresAt: theFuture },
-    });
-    const openIdConnect = new OpenIdConnect({
-      sessionManager: { getSession } as any,
-      scopeTransform,
-    });
-
-    expect(await openIdConnect.getIdToken({ optional: true })).toBe('id-token');
-    expect(getSession).toBeCalledTimes(1);
-  });
-
-  it('should share popup closed errors', async () => {
-    const error = new Error('NOPE');
-    error.name = 'RejectedError';
-    const getSession = jest
-      .fn()
-      .mockResolvedValueOnce({
-        providerInfo: {
-          accessToken: 'access-token',
-          expiresAt: theFuture,
-          scopes: new Set([`${PREFIX}not-enough`]),
-        },
-      })
-      .mockRejectedValue(error);
-    const openIdConnect = new OpenIdConnect({
-      sessionManager: { getSession } as any,
-      scopeTransform,
-    });
-
-    // Make sure we have a session before we do the double request, so that we get past the !this.currentSession check
-    await expect(openIdConnect.getAccessToken()).resolves.toBe('access-token');
-
-    const promise1 = openIdConnect.getAccessToken('more');
-    const promise2 = openIdConnect.getAccessToken('more');
-    await expect(promise1).rejects.toBe(error);
-    await expect(promise2).rejects.toBe(error);
-    expect(getSession).toBeCalledTimes(3);
-  });
-
-  it('should wait for all session refreshes', async () => {
-    const initialSession = {
-      providerInfo: {
-        idToken: 'token1',
-        expiresAt: theFuture,
-        scopes: new Set(),
-      },
-    };
-    const getSession = jest
-      .fn()
-      .mockResolvedValueOnce(initialSession)
-      .mockResolvedValue({
-        providerInfo: {
-          idToken: 'token2',
-          expiresAt: theFuture,
-          scopes: new Set(),
-        },
-      });
-    const openIdConnect = new OpenIdConnect({
-      sessionManager: { getSession } as any,
-      scopeTransform,
-    });
-
-    // Grab the expired session first
-    await expect(openIdConnect.getIdToken()).resolves.toBe('token1');
-    expect(getSession).toBeCalledTimes(1);
-
-    initialSession.providerInfo.expiresAt = thePast;
-
-    const promise1 = openIdConnect.getIdToken();
-    const promise2 = openIdConnect.getIdToken();
-    const promise3 = openIdConnect.getIdToken();
-    await expect(promise1).resolves.toBe('token2');
-    await expect(promise2).resolves.toBe('token2');
-    await expect(promise3).resolves.toBe('token2');
-    expect(getSession).toBeCalledTimes(4); // De-duping of session requests happens in client
-  });
-});
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts b/packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts
deleted file mode 100644
index deb8331432..0000000000
--- a/packages/core-api/src/apis/implementations/auth/oidc/Oidc.ts
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * Copyright 2020 Spotify AB
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import OpenIdConnectIcon from '@material-ui/icons/AcUnit';
-import { DefaultAuthConnector } from '../../../../lib/AuthConnector';
-import { RefreshingAuthSessionManager } from '../../../../lib/AuthSessionManager';
-import { SessionManager } from '../../../../lib/AuthSessionManager/types';
-import { Observable } from '../../../../types';
-import {
-  AuthRequestOptions,
-  BackstageIdentity,
-  OAuthApi,
-  OpenIdConnectApi,
-  ProfileInfo,
-  ProfileInfoApi,
-  SessionState,
-  SessionApi,
-  BackstageIdentityApi,
-} from '../../../definitions/auth';
-import { OpenIdConnectSession } from './types';
-import { OAuthApiCreateOptions } from '../types';
-
-type Options = {
-  sessionManager: SessionManager<OpenIdConnectSession>;
-  scopeTransform: (scopes: string[]) => string[];
-};
-
-type CreateOptions = OAuthApiCreateOptions & {
-  scopeTransform?: (scopes: string[]) => string[];
-};
-
-export type OpenIdConnectResponse = {
-  providerInfo: {
-    accessToken: string;
-    idToken: string;
-    scope: string;
-    expiresInSeconds: number;
-  };
-  profile: ProfileInfo;
-  backstageIdentity: BackstageIdentity;
-};
-
-const DEFAULT_PROVIDER = {
-  id: 'oidc',
-  title: 'Open ID Connect Identity Provider',
-  icon: OpenIdConnectIcon,
-};
-
-class OpenIdConnect
-  implements
-    OAuthApi,
-    OpenIdConnectApi,
-    ProfileInfoApi,
-    BackstageIdentityApi,
-    SessionApi {
-  static create({
-    discoveryApi,
-    environment = 'development',
-    provider = DEFAULT_PROVIDER,
-    oauthRequestApi,
-    defaultScopes = [],
-    scopeTransform = x => x,
-  }: CreateOptions) {
-    const connector = new DefaultAuthConnector({
-      discoveryApi,
-      environment,
-      provider,
-      oauthRequestApi: oauthRequestApi,
-      sessionTransform(res: OpenIdConnectResponse): OpenIdConnectSession {
-        return {
-          ...res,
-          providerInfo: {
-            idToken: res.providerInfo.idToken,
-            accessToken: res.providerInfo.accessToken,
-            scopes: OpenIdConnect.normalizeScopes(
-              scopeTransform,
-              res.providerInfo.scope,
-            ),
-            expiresAt: new Date(
-              Date.now() + res.providerInfo.expiresInSeconds * 1000,
-            ),
-          },
-        };
-      },
-    });
-
-    const sessionManager = new RefreshingAuthSessionManager({
-      connector,
-      defaultScopes: new Set(defaultScopes),
-      sessionScopes: (session: OpenIdConnectSession) =>
-        session.providerInfo.scopes,
-      sessionShouldRefresh: (session: OpenIdConnectSession) => {
-        const expiresInSec =
-          (session.providerInfo.expiresAt.getTime() - Date.now()) / 1000;
-        return expiresInSec < 60 * 5;
-      },
-    });
-
-    return new OpenIdConnect({ sessionManager, scopeTransform });
-  }
-
-  private readonly sessionManager: SessionManager<OpenIdConnectSession>;
-  private readonly scopeTransform: (scopes: string[]) => string[];
-
-  constructor(options: Options) {
-    this.sessionManager = options.sessionManager;
-    this.scopeTransform = options.scopeTransform;
-  }
-
-  async signIn() {
-    await this.getAccessToken();
-  }
-
-  async signOut() {
-    await this.sessionManager.removeSession();
-  }
-
-  sessionState$(): Observable<SessionState> {
-    return this.sessionManager.sessionState$();
-  }
-
-  async getAccessToken(
-    scope?: string | string[],
-    options?: AuthRequestOptions,
-  ) {
-    const normalizedScopes = OpenIdConnect.normalizeScopes(
-      this.scopeTransform,
-      scope,
-    );
-    const session = await this.sessionManager.getSession({
-      ...options,
-      scopes: normalizedScopes,
-    });
-    return session?.providerInfo.accessToken ?? '';
-  }
-
-  async getIdToken(options: AuthRequestOptions = {}) {
-    const session = await this.sessionManager.getSession(options);
-    return session?.providerInfo.idToken ?? '';
-  }
-
-  async getBackstageIdentity(
-    options: AuthRequestOptions = {},
-  ): Promise<BackstageIdentity | undefined> {
-    const session = await this.sessionManager.getSession(options);
-    return session?.backstageIdentity;
-  }
-
-  async getProfile(options: AuthRequestOptions = {}) {
-    const session = await this.sessionManager.getSession(options);
-    return session?.profile;
-  }
-
-  private static normalizeScopes(
-    scopeTransform: (scopes: string[]) => string[],
-    scopes?: string | string[],
-  ): Set<string> {
-    if (!scopes) {
-      return new Set();
-    }
-
-    const scopeList = Array.isArray(scopes)
-      ? scopes
-      : scopes.split(/[\s|,]/).filter(Boolean);
-
-    return new Set(scopeTransform(scopeList));
-  }
-}
-
-export default OpenIdConnect;
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/index.ts b/packages/core-api/src/apis/implementations/auth/oidc/index.ts
deleted file mode 100644
index cf9add0757..0000000000
--- a/packages/core-api/src/apis/implementations/auth/oidc/index.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- * Copyright 2020 Spotify AB
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-export { default as OpenIdConnect } from './Oidc';
-export * from './types';
diff --git a/packages/core-api/src/apis/implementations/auth/oidc/types.ts b/packages/core-api/src/apis/implementations/auth/oidc/types.ts
deleted file mode 100644
index ae9696c229..0000000000
--- a/packages/core-api/src/apis/implementations/auth/oidc/types.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright 2020 Spotify AB
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { ProfileInfo, BackstageIdentity } from '../../../definitions';
-
-export type OpenIdConnectSession = {
-  providerInfo: {
-    idToken: string;
-    accessToken: string;
-    scopes: Set<string>;
-    expiresAt: Date;
-  };
-  profile: ProfileInfo;
-  backstageIdentity: BackstageIdentity;
-};
diff --git a/packages/core/src/api-wrappers/defaultApis.ts b/packages/core/src/api-wrappers/defaultApis.ts
index adc5fce30a..9b3d26fb4d 100644
--- a/packages/core/src/api-wrappers/defaultApis.ts
+++ b/packages/core/src/api-wrappers/defaultApis.ts
@@ -47,7 +47,6 @@ import {
   oneloginAuthApiRef,
   OneLoginAuth,
   oidcApiRef,
-  OpenIdConnect,
 } from '@backstage/core-api';
 
 export const defaultApis = [
@@ -162,6 +161,6 @@ export const defaultApis = [
       oauthRequestApi: oauthRequestApiRef,
     },
     factory: ({ discoveryApi, oauthRequestApi }) =>
-      OpenIdConnect.create({ discoveryApi, oauthRequestApi }),
+      OAuth2.create({ discoveryApi, oauthRequestApi }),
   }),
 ];
diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
index ed1488851e..71ea2c4103 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -46,9 +46,7 @@ type PrivateInfo = {
 };
 
 export type OidcAuthProviderOptions = OAuthProviderOptions & {
-  authorizationUrl: string;
-  tokenUrl: string;
-  adUrl: string;
+  metadataUrl: string;
   tokenSignedResponseAlg?: string;
 };
 
@@ -118,8 +116,7 @@ export class OidcAuthProvider implements OAuthHandlers {
   private async setupStrategy(
     options: OidcAuthProviderOptions,
   ): Promise<OidcStrategy<UserinfoResponse, Client>> {
-    const issuer = await Issuer.discover(options.adUrl);
-    // console.log('Discovered issuer %s %O', issuer.issuer, issuer.metadata);
+    const issuer = await Issuer.discover(options.metadataUrl);
     const client = new issuer.Client({
       client_id: options.clientId,
       client_secret: options.clientSecret,
@@ -191,9 +188,7 @@ export const createOidcProvider: AuthProviderFactory = ({
     const clientId = envConfig.getString('clientId');
     const clientSecret = envConfig.getString('clientSecret');
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
-    const authorizationUrl = envConfig.getString('authorizationUrl');
-    const adUrl = envConfig.getString('adUrl');
-    const tokenUrl = envConfig.getString('tokenUrl');
+    const metadataUrl = envConfig.getString('metadataUrl');
     const tokenSignedResponseAlg = envConfig.getString(
       'tokenSignedResponseAlg',
     );
@@ -202,10 +197,8 @@ export const createOidcProvider: AuthProviderFactory = ({
       clientId,
       clientSecret,
       callbackUrl,
-      authorizationUrl,
-      tokenUrl,
       tokenSignedResponseAlg,
-      adUrl,
+      metadataUrl,
     });
 
     return OAuthAdapter.fromConfig(globalConfig, provider, {

From 5c485ff60ff2c381e7083449c57cea58586b4acc Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Thu, 19 Nov 2020 09:11:13 -0800
Subject: [PATCH 07/12] Added a auth.session.secret config value for setting
 the express session secret

---
 app-config.yaml                            |  2 ++
 plugins/auth-backend/package.json          | 23 +++++++++++++++++++++-
 plugins/auth-backend/src/service/router.ts |  4 +++-
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/app-config.yaml b/app-config.yaml
index cfa47618e8..34a0b09520 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -191,6 +191,8 @@ scaffolder:
         $env: AZURE_TOKEN
 
 auth:
+  session:
+    secret: yaml session secret
   providers:
     google:
       development:
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index f1ad45d9e5..94502775e4 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -71,5 +71,26 @@
   "files": [
     "dist",
     "migrations"
-  ]
+  ],
+  "configSchema": {
+    "$schema": "https://backstage.io/schema/config-v1",
+    "title": "@backstage/auth-backend",
+    "type": "object",
+    "properties": {
+      "auth": {
+        "type": "object",
+        "properties": {
+          "session": {
+            "type": "object",
+            "properties": {
+              "secret": {
+                "type": "string",
+                "visibility": "secret"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
 }
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index e8624d36b3..1baa1d4892 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -60,7 +60,9 @@ export async function createRouter({
   });
   const catalogApi = new CatalogClient({ discoveryApi: discovery });
 
-  const secret = 'backstage secret'; // TODO: Allow an override here
+  const secret =
+    config.getOptionalString('auth.session.secret') ?? 'backstage secret';
+  console.log('using secret', secret);
   router.use(cookieParser(secret));
   router.use(session({ secret, saveUninitialized: false, resave: false }));
   router.use(express.urlencoded({ extended: false }));

From 78b390483df0dbc4f4369d4887a157c4df2692d5 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Thu, 19 Nov 2020 11:13:04 -0800
Subject: [PATCH 08/12] Added a oidc provider test

---
 plugins/auth-backend/package.json             |  4 +-
 .../src/providers/oidc/provider.test.ts       | 60 +++++++++++++++++++
 .../src/providers/oidc/provider.ts            |  2 +-
 yarn.lock                                     | 22 +++++++
 4 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 plugins/auth-backend/src/providers/oidc/provider.test.ts

diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 94502775e4..4d1e52aa21 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -60,13 +60,15 @@
     "@types/cookie-parser": "^1.4.2",
     "@types/express-session": "^1.17.2",
     "@types/jwt-decode": "2.2.1",
+    "@types/nock": "^11.1.0",
     "@types/openid-client": "^3.7.0",
     "@types/passport": "^1.0.3",
     "@types/passport-github2": "^1.2.4",
     "@types/passport-google-oauth20": "^2.0.3",
     "@types/passport-microsoft": "^0.0.0",
     "@types/passport-saml": "^1.1.2",
-    "msw": "^0.21.2"
+    "msw": "^0.21.2",
+    "nock": "^13.0.5"
   },
   "files": [
     "dist",
diff --git a/plugins/auth-backend/src/providers/oidc/provider.test.ts b/plugins/auth-backend/src/providers/oidc/provider.test.ts
new file mode 100644
index 0000000000..e8b414edf2
--- /dev/null
+++ b/plugins/auth-backend/src/providers/oidc/provider.test.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2020 Spotify AB
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import nock from 'nock';
+import { ClientMetadata, IssuerMetadata } from 'openid-client';
+import { OidcAuthProvider } from './provider';
+
+const issuerMetadata = {
+  issuer: 'https://oidc.test',
+  authorization_endpoint: 'https://oidc.test/as/authorization.oauth2',
+  token_endpoint: 'https://oidc.test/as/token.oauth2',
+  revocation_endpoint: 'https://oidc.test/as/revoke_token.oauth2',
+  userinfo_endpoint: 'https://oidc.test/idp/userinfo.openid',
+  introspection_endpoint: 'https://oidc.test/as/introspect.oauth2',
+  jwks_uri: 'https://oidc.test/pf/JWKS',
+  scopes_supported: ['openid'],
+  claims_supported: ['email'],
+  response_types_supported: ['code'],
+  id_token_signing_alg_values_supported: ['RS256', 'RS512'],
+  token_endpoint_auth_signing_alg_values_supported: ['RS256', 'RS512'],
+  request_object_signing_alg_values_supported: ['RS256', 'RS512'],
+};
+
+const clientMetadata = {
+  callbackUrl: 'https://oidc.test/callback',
+  clientId: 'testclientid',
+  clientSecret: 'testclientsecret',
+  metadataUrl: 'https://oidc.test/.well-known/openid-configuration',
+};
+
+describe('OidcAuthProvider', () => {
+  it('hit the metadataurl', async () => {
+    const scope = nock('https://oidc.test')
+      .get('/.well-known/openid-configuration')
+      .reply(200, issuerMetadata);
+    const provider = new OidcAuthProvider(clientMetadata);
+    const strategy = ((await provider._strategy) as any) as {
+      _client: ClientMetadata;
+      _issuer: IssuerMetadata;
+    };
+    // Assert that the expected request to the metadaurl was made.
+    expect(scope.isDone()).toBeTruthy();
+    const { _client, _issuer } = strategy;
+    expect(_client.client_id).toBe(clientMetadata.clientId);
+    expect(_issuer.token_endpoint).toBe(issuerMetadata.token_endpoint);
+  });
+});
diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts
index 71ea2c4103..5ebb859f2f 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.ts
@@ -51,7 +51,7 @@ export type OidcAuthProviderOptions = OAuthProviderOptions & {
 };
 
 export class OidcAuthProvider implements OAuthHandlers {
-  private readonly _strategy: Promise<OidcStrategy<UserinfoResponse, Client>>;
+  readonly _strategy: Promise<OidcStrategy<UserinfoResponse, Client>>;
 
   constructor(options: OidcAuthProviderOptions) {
     this._strategy = this.setupStrategy(options);
diff --git a/yarn.lock b/yarn.lock
index 2c4d23e8d7..ba25713fdc 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5521,6 +5521,13 @@
   dependencies:
     "@types/node" "*"
 
+"@types/nock@^11.1.0":
+  version "11.1.0"
+  resolved "https://registry.npmjs.org/@types/nock/-/nock-11.1.0.tgz#0a8c1056a31ba32a959843abccf99626dd90a538"
+  integrity sha512-jI/ewavBQ7X5178262JQR0ewicPAcJhXS/iFaNJl0VHLfyosZ/kwSrsa6VNQNSO8i9d8SqdRgOtZSOKJ/+iNMw==
+  dependencies:
+    nock "*"
+
 "@types/node-fetch@2.5.7", "@types/node-fetch@^2.5.4":
   version "2.5.7"
   resolved "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.5.7.tgz#20a2afffa882ab04d44ca786449a276f9f6bbf3c"
@@ -17139,6 +17146,16 @@ no-case@^3.0.3:
     lower-case "^2.0.1"
     tslib "^1.10.0"
 
+nock@*, nock@^13.0.5:
+  version "13.0.5"
+  resolved "https://registry.npmjs.org/nock/-/nock-13.0.5.tgz#a618c6f86372cb79fac04ca9a2d1e4baccdb2414"
+  integrity sha512-1ILZl0zfFm2G4TIeJFW0iHknxr2NyA+aGCMTjDVUsBY4CkMRispF1pfIYkTRdAR/3Bg+UzdEuK0B6HczMQZcCg==
+  dependencies:
+    debug "^4.1.0"
+    json-stringify-safe "^5.0.1"
+    lodash.set "^4.3.2"
+    propagate "^2.0.0"
+
 node-addon-api@2.0.0:
   version "2.0.0"
   resolved "https://registry.npmjs.org/node-addon-api/-/node-addon-api-2.0.0.tgz#f9afb8d777a91525244b01775ea0ddbe1125483b"
@@ -19385,6 +19402,11 @@ prop-types@^15.5.10, prop-types@^15.5.8, prop-types@^15.6.0, prop-types@^15.6.1,
     object-assign "^4.1.1"
     react-is "^16.8.1"
 
+propagate@^2.0.0:
+  version "2.0.1"
+  resolved "https://registry.npmjs.org/propagate/-/propagate-2.0.1.tgz#40cdedab18085c792334e64f0ac17256d38f9a45"
+  integrity sha512-vGrhOavPSTz4QVNuBNdcNXePNdNMaO1xj9yBeH1ScQPjk/rhg9sSlCXPhMkFuaNNW/syTvYqsnbIJxMBfRbbag==
+
 property-expr@^2.0.2:
   version "2.0.2"
   resolved "https://registry.npmjs.org/property-expr/-/property-expr-2.0.2.tgz#fff2a43919135553a3bc2fdd94bdb841965b2330"

From 3712c47974e67a6a4d4d3e29569ecf470d27a355 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Thu, 19 Nov 2020 17:35:03 -0800
Subject: [PATCH 09/12] Added a test for the OidcAuthProvider handler method

---
 .../src/providers/oidc/provider.test.ts       | 43 +++++++++++++++++--
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/plugins/auth-backend/src/providers/oidc/provider.test.ts b/plugins/auth-backend/src/providers/oidc/provider.test.ts
index e8b414edf2..0ad464f607 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.test.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.test.ts
@@ -14,9 +14,12 @@
  * limitations under the License.
  */
 
+import express from 'express';
+import { Session } from 'express-session';
 import nock from 'nock';
 import { ClientMetadata, IssuerMetadata } from 'openid-client';
 import { OidcAuthProvider } from './provider';
+import { JWT, JWK } from 'jose';
 
 const issuerMetadata = {
   issuer: 'https://oidc.test',
@@ -29,9 +32,9 @@ const issuerMetadata = {
   scopes_supported: ['openid'],
   claims_supported: ['email'],
   response_types_supported: ['code'],
-  id_token_signing_alg_values_supported: ['RS256', 'RS512'],
-  token_endpoint_auth_signing_alg_values_supported: ['RS256', 'RS512'],
-  request_object_signing_alg_values_supported: ['RS256', 'RS512'],
+  id_token_signing_alg_values_supported: ['RS256', 'RS512', 'HS256'],
+  token_endpoint_auth_signing_alg_values_supported: ['RS256', 'RS512', 'HS256'],
+  request_object_signing_alg_values_supported: ['RS256', 'RS512', 'HS256'],
 };
 
 const clientMetadata = {
@@ -39,10 +42,11 @@ const clientMetadata = {
   clientId: 'testclientid',
   clientSecret: 'testclientsecret',
   metadataUrl: 'https://oidc.test/.well-known/openid-configuration',
+  tokenSignedResponseAlg: 'none',
 };
 
 describe('OidcAuthProvider', () => {
-  it('hit the metadataurl', async () => {
+  it('hit the metadata url', async () => {
     const scope = nock('https://oidc.test')
       .get('/.well-known/openid-configuration')
       .reply(200, issuerMetadata);
@@ -57,4 +61,35 @@ describe('OidcAuthProvider', () => {
     expect(_client.client_id).toBe(clientMetadata.clientId);
     expect(_issuer.token_endpoint).toBe(issuerMetadata.token_endpoint);
   });
+
+  it('OidcAuthProvider#handler successfully invokes the oidc endpoints', async () => {
+    const jwt = {
+      sub: 'alice',
+      iss: 'https://oidc.test',
+      aud: clientMetadata.clientId,
+      exp: Date.now() + 10000,
+    };
+    const scope = nock('https://oidc.test')
+      .get('/.well-known/openid-configuration')
+      .reply(200, issuerMetadata)
+      .post('/as/token.oauth2')
+      .reply(200, {
+        id_token: JWT.sign(jwt, JWK.None),
+        access_token: 'test',
+        authorization_signed_response_alg: 'HS256',
+      })
+      .get('/idp/userinfo.openid')
+      .reply(200, {
+        sub: 'alice',
+        email: 'alice@oidc.test',
+      });
+    const provider = new OidcAuthProvider(clientMetadata);
+    const req = {
+      method: 'GET',
+      url: '/?code=test2',
+      session: ({ 'oidc:oidc.test': 'test' } as any) as Session,
+    } as express.Request;
+    await provider.handler(req);
+    expect(scope.isDone()).toBeTruthy();
+  });
 });

From afaaf96eccccd91ea914f3e52a9ea14e1e3ae6e6 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Thu, 19 Nov 2020 23:49:12 -0800
Subject: [PATCH 10/12] Cleanup and fixes after refactoring

---
 app-config.yaml                                |  4 ++--
 packages/app/src/identityProviders.ts          |  4 ++--
 packages/core-api/src/apis/definitions/auth.ts |  2 +-
 packages/core/src/api-wrappers/defaultApis.ts  | 16 +++++++++++++---
 4 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/app-config.yaml b/app-config.yaml
index 34a0b09520..8dc870a7cd 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -239,8 +239,8 @@ auth:
           $env: AUTH_OAUTH2_TOKEN_URL
     oidc:
       development:
-        adUrl:
-          $env: AUTH_OIDC_AD_URL
+        metadataUrl:
+          $env: AUTH_OIDC_METADATA_URL
         clientId:
           $env: AUTH_OIDC_CLIENT_ID
         clientSecret:
diff --git a/packages/app/src/identityProviders.ts b/packages/app/src/identityProviders.ts
index ba657328f2..01828b1405 100644
--- a/packages/app/src/identityProviders.ts
+++ b/packages/app/src/identityProviders.ts
@@ -22,7 +22,7 @@ import {
   samlAuthApiRef,
   microsoftAuthApiRef,
   oneloginAuthApiRef,
-  oidcApiRef,
+  oidcAuthApiRef,
 } from '@backstage/core';
 
 export const providers = [
@@ -30,7 +30,7 @@ export const providers = [
     id: 'oidc-auth-provider',
     title: 'Oidc',
     message: 'Sign In using OpenId Connect',
-    apiRef: oidcApiRef,
+    apiRef: oidcAuthApiRef,
   },
   {
     id: 'google-auth-provider',
diff --git a/packages/core-api/src/apis/definitions/auth.ts b/packages/core-api/src/apis/definitions/auth.ts
index 5dae5532ad..30b07887ad 100644
--- a/packages/core-api/src/apis/definitions/auth.ts
+++ b/packages/core-api/src/apis/definitions/auth.ts
@@ -314,7 +314,7 @@ export const oauth2ApiRef: ApiRef<
 /**
  * Provides authentication for custom OpenID Connect identity providers.
  */
-export const oidcApiRef: ApiRef<
+export const oidcAuthApiRef: ApiRef<
   OAuthApi &
     OpenIdConnectApi &
     ProfileInfoApi &
diff --git a/packages/core/src/api-wrappers/defaultApis.ts b/packages/core/src/api-wrappers/defaultApis.ts
index 9b3d26fb4d..1f18f54d2a 100644
--- a/packages/core/src/api-wrappers/defaultApis.ts
+++ b/packages/core/src/api-wrappers/defaultApis.ts
@@ -46,9 +46,11 @@ import {
   SamlAuth,
   oneloginAuthApiRef,
   OneLoginAuth,
-  oidcApiRef,
+  oidcAuthApiRef,
 } from '@backstage/core-api';
 
+import OAuth2Icon from '@material-ui/icons/AcUnit';
+
 export const defaultApis = [
   createApiFactory({
     api: discoveryApiRef,
@@ -155,12 +157,20 @@ export const defaultApis = [
       OneLoginAuth.create({ discoveryApi, oauthRequestApi }),
   }),
   createApiFactory({
-    api: oidcApiRef,
+    api: oidcAuthApiRef,
     deps: {
       discoveryApi: discoveryApiRef,
       oauthRequestApi: oauthRequestApiRef,
     },
     factory: ({ discoveryApi, oauthRequestApi }) =>
-      OAuth2.create({ discoveryApi, oauthRequestApi }),
+      OAuth2.create({
+        discoveryApi,
+        oauthRequestApi,
+        provider: {
+          id: 'oidc',
+          title: 'Your Identity Provider',
+          icon: OAuth2Icon,
+        },
+      }),
   }),
 ];

From 68be35912b8e0c52c701e5a9e172a3b1cd9afb6f Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Fri, 20 Nov 2020 10:07:59 -0800
Subject: [PATCH 11/12] Conditionally enable the auth-backend session support

---
 app-config.yaml                            |  6 +++---
 plugins/auth-backend/src/service/router.ts | 16 +++++++++++-----
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/app-config.yaml b/app-config.yaml
index 8dc870a7cd..fcc54a1a35 100644
--- a/app-config.yaml
+++ b/app-config.yaml
@@ -189,10 +189,10 @@ scaffolder:
     api:
       token:
         $env: AZURE_TOKEN
-
 auth:
-  session:
-    secret: yaml session secret
+  ### Providing an auth.session.secret will enable session support in the auth-backend
+  # session:
+  #   secret: custom session secret
   providers:
     google:
       development:
diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 1baa1d4892..47e0d14caa 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -28,6 +28,7 @@ import { Logger } from 'winston';
 import { createOidcRouter, DatabaseKeyStore, TokenFactory } from '../identity';
 import { createAuthProvider } from '../providers';
 import session from 'express-session';
+import passport from 'passport';
 
 export interface RouterOptions {
   logger: Logger;
@@ -60,11 +61,16 @@ export async function createRouter({
   });
   const catalogApi = new CatalogClient({ discoveryApi: discovery });
 
-  const secret =
-    config.getOptionalString('auth.session.secret') ?? 'backstage secret';
-  console.log('using secret', secret);
-  router.use(cookieParser(secret));
-  router.use(session({ secret, saveUninitialized: false, resave: false }));
+  const secret = config.getOptionalString('auth.session.secret');
+  if (secret) {
+    router.use(cookieParser(secret));
+    // TODO: Configure the server-side session storage.  The default MemoryStore is not designed for production
+    router.use(session({ secret, saveUninitialized: false, resave: false }));
+    router.use(passport.initialize());
+    router.use(passport.session());
+  } else {
+    router.use(cookieParser());
+  }
   router.use(express.urlencoded({ extended: false }));
   router.use(express.json());
 

From 40b3036fac715bb7ee81b673ec397b7951876a35 Mon Sep 17 00:00:00 2001
From: Brian Leathem <bleathem@netflix.com>
Date: Fri, 20 Nov 2020 11:57:00 -0800
Subject: [PATCH 12/12] Added a test for the createOidcProvider method

---
 .../src/providers/oidc/provider.test.ts       | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/plugins/auth-backend/src/providers/oidc/provider.test.ts b/plugins/auth-backend/src/providers/oidc/provider.test.ts
index 0ad464f607..ade69255b7 100644
--- a/plugins/auth-backend/src/providers/oidc/provider.test.ts
+++ b/plugins/auth-backend/src/providers/oidc/provider.test.ts
@@ -18,8 +18,11 @@ import express from 'express';
 import { Session } from 'express-session';
 import nock from 'nock';
 import { ClientMetadata, IssuerMetadata } from 'openid-client';
-import { OidcAuthProvider } from './provider';
+import { createOidcProvider, OidcAuthProvider } from './provider';
 import { JWT, JWK } from 'jose';
+import { AuthProviderFactoryOptions } from '../types';
+import { Config } from '@backstage/config';
+import { OAuthAdapter } from '../../lib/oauth';
 
 const issuerMetadata = {
   issuer: 'https://oidc.test',
@@ -92,4 +95,21 @@ describe('OidcAuthProvider', () => {
     await provider.handler(req);
     expect(scope.isDone()).toBeTruthy();
   });
+
+  const options = {
+    globalConfig: {
+      appUrl: 'https://oidc.test',
+      baseUrl: 'https://oidc.test',
+    },
+    config: ({
+      keys: jest.fn(() => ['test']),
+      getConfig: jest.fn(() => ({ getString: () => '' })),
+    } as any) as Config,
+  } as AuthProviderFactoryOptions;
+
+  it('createOidcProvider', () => {
+    const provider = createOidcProvider(options) as OAuthAdapter;
+    console.log(provider);
+    expect(provider.start).toBeDefined();
+  });
 });