Merge remote-tracking branch 'upstream/master' into entra-rename

plugins/auth-backend/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @backstage/plugin-auth-backend
 
+## 0.20.0-next.0
+
+### Minor Changes
+
+- bdf08ad04a: Adds the StaticTokenIssuer and StaticKeyStore, an alternative token issuer that can be used to sign the Authorization header using a predefined public/private key pair.
+
+### Patch Changes
+
+- 96c4f54bf6: Reverted the Microsoft auth provider to the previous implementation.
+- Updated dependencies
+  - @backstage/backend-common@0.19.9-next.0
+  - @backstage/backend-plugin-api@0.6.7-next.0
+  - @backstage/catalog-client@1.4.5
+  - @backstage/catalog-model@1.4.3
+  - @backstage/config@1.1.1
+  - @backstage/errors@1.2.3
+  - @backstage/types@1.1.1
+  - @backstage/plugin-auth-backend-module-gcp-iap-provider@0.2.1-next.0
+  - @backstage/plugin-auth-backend-module-github-provider@0.1.4-next.0
+  - @backstage/plugin-auth-backend-module-gitlab-provider@0.1.4-next.0
+  - @backstage/plugin-auth-backend-module-google-provider@0.1.4-next.0
+  - @backstage/plugin-auth-backend-module-oauth2-provider@0.1.4-next.0
+  - @backstage/plugin-auth-node@0.4.1-next.0
+  - @backstage/plugin-catalog-node@1.4.8-next.0
+
 ## 0.19.3
 
 ### Patch Changes

plugins/auth-backend/README.md

@@ -158,6 +158,10 @@ To try out SAML, you can use the mock identity provider:
 
 [How to add an auth provider](https://github.com/backstage/backstage/blob/master/docs/auth/add-auth-provider.md)
 
+## Token issuers
+
+[Configuring token issuers](https://github.com/backstage/backstage/blob/master/docs/auth/index.md)
+
 ## Links
 
 - [The Backstage homepage](https://backstage.io)

plugins/auth-backend/api-report.md

@@ -538,9 +538,9 @@ export const providers: Readonly<{
         | undefined,
     ) => AuthProviderFactory_2;
     resolvers: Readonly<{
-      emailMatchingUserEntityProfileEmail: () => SignInResolver_2<OAuthResult>;
-      emailLocalPartMatchingUserEntityName: () => SignInResolver_2<OAuthResult>;
-      emailMatchingUserEntityAnnotation: () => SignInResolver_2<OAuthResult>;
+      emailLocalPartMatchingUserEntityName: () => SignInResolver<unknown>;
+      emailMatchingUserEntityProfileEmail: () => SignInResolver<unknown>;
+      emailMatchingUserEntityAnnotation(): SignInResolver<OAuthResult>;
     }>;
   }>;
   oauth2: Readonly<{

plugins/auth-backend/config.d.ts

@@ -43,7 +43,7 @@ export interface Config {
 
     /** To control how to store JWK data in auth-backend */
     keyStore?: {
-      provider?: 'database' | 'memory' | 'firestore';
+      provider?: 'database' | 'memory' | 'firestore' | 'static';
       firestore?: {
         /** The host to connect to */
         host?: string;
@@ -65,6 +65,21 @@ export interface Config {
         /** Timeout used for database operations. Defaults to 10000ms */
         timeout?: number;
       };
+      static?: {
+        /** Must be declared at least once and the first one will be used for signing */
+        keys: Array<{
+          /** Path to the public key file in the SPKI format */
+          publicKeyFile: string;
+          /** Path to the matching private key file in the PKCS#8 format */
+          privateKeyFile: string;
+          /** id to uniquely identify this key within the JWK set */
+          keyId: string;
+          /** JWS "alg" (Algorithm) Header Parameter value. Defaults to ES256.
+           * Must match the algorithm used to generate the keys in the provided files
+           */
+          algorithm?: string;
+        }>;
+      };
     };
 
     /**
@@ -179,6 +194,18 @@ export interface Config {
         };
       };
       /** @visibility frontend */
+      microsoft?: {
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          tenantId: string;
+          callbackUrl?: string;
+        };
+      };
+      /** @visibility frontend */
       onelogin?: {
         [authEnv: string]: {
           clientId: string;

plugins/auth-backend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-auth-backend",
   "description": "A Backstage backend plugin that handles authentication",
-  "version": "0.19.3",
+  "version": "0.20.0-next.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "license": "Apache-2.0",
@@ -42,7 +42,6 @@
     "@backstage/plugin-auth-backend-module-github-provider": "workspace:^",
     "@backstage/plugin-auth-backend-module-gitlab-provider": "workspace:^",
     "@backstage/plugin-auth-backend-module-google-provider": "workspace:^",
-    "@backstage/plugin-auth-backend-module-microsoft-provider": "workspace:^",
     "@backstage/plugin-auth-backend-module-oauth2-provider": "workspace:^",
     "@backstage/plugin-auth-node": "workspace:^",
     "@backstage/plugin-catalog-node": "workspace:^",

plugins/auth-backend/src/identity/KeyStores.ts

@@ -18,12 +18,12 @@ import { pickBy } from 'lodash';
 import { LoggerService } from '@backstage/backend-plugin-api';
 
 import { Config } from '@backstage/config';
-
 import { AuthDatabase } from '../database/AuthDatabase';
 import { DatabaseKeyStore } from './DatabaseKeyStore';
 import { FirestoreKeyStore } from './FirestoreKeyStore';
 import { MemoryKeyStore } from './MemoryKeyStore';
 import { KeyStore } from './types';
+import { StaticKeyStore } from './StaticKeyStore';
 
 type Options = {
   logger: LoggerService;
@@ -75,6 +75,10 @@ export class KeyStores {
       return keyStore;
     }
 
+    if (provider === 'static') {
+      await StaticKeyStore.fromConfig(config);
+    }
+
     throw new Error(`Unknown KeyStore provider: ${provider}`);
   }
 }

plugins/auth-backend/src/identity/StaticKeyStore.test.ts

@@ -0,0 +1,113 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { StaticKeyStore } from './StaticKeyStore';
+import { AnyJWK } from './types';
+import { ConfigReader } from '@backstage/config';
+import { createMockDirectory } from '@backstage/backend-test-utils';
+
+const privateKey = `
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgR8Ja2ppMEgOm1KeY
+Kpje00U1luybndt6yC263vcgeKqhRANCAAS+slUrS9JXgtHB1RcDnmlveuu4H3Zm
+hQRjvYdO+Mg/3FJss6FaExESTzhPSr3X+be/exarkTMchbDXNEdCKwpn
+-----END PRIVATE KEY-----
+`.trim();
+
+const publicKey = `
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvrJVK0vSV4LRwdUXA55pb3rruB92
+ZoUEY72HTvjIP9xSbLOhWhMREk84T0q91/m3v3sWq5EzHIWw1zRHQisKZw==
+-----END PUBLIC KEY-----
+`.trim();
+
+describe('StaticKeyStore', () => {
+  let config: ConfigReader;
+  const sourceDir = createMockDirectory();
+
+  beforeAll(() => {
+    sourceDir.setContent({
+      'public.pem': publicKey,
+      'private.pem': privateKey,
+    });
+
+    const publicKeyPath = sourceDir.resolve('public.pem');
+    const privateKeyPath = sourceDir.resolve('private.pem');
+    config = new ConfigReader({
+      auth: {
+        keyStore: {
+          static: {
+            keys: [
+              {
+                publicKeyFile: publicKeyPath,
+                privateKeyFile: privateKeyPath,
+                keyId: '1',
+                algorithm: 'ES256',
+              },
+              {
+                publicKeyFile: publicKeyPath,
+                privateKeyFile: privateKeyPath,
+                keyId: '2',
+                algorithm: 'ES256',
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
+  it('should provide keys from disk', async () => {
+    const staticKeyStore = await StaticKeyStore.fromConfig(config);
+    const keys = await staticKeyStore.listKeys();
+    expect(keys.items.length).toEqual(2);
+    expect(keys.items[0].key).toMatchObject({
+      kid: '1',
+      alg: 'ES256',
+    });
+    expect(keys.items[1].key).toMatchObject({
+      kid: '2',
+      alg: 'ES256',
+    });
+
+    const pk = staticKeyStore.getPrivateKey('1');
+    expect(pk).toMatchObject({
+      kid: '1',
+      alg: 'ES256',
+    });
+    expect(pk.d).toBeDefined();
+  });
+
+  it('should not allow users to add keys', async () => {
+    const staticKeyStore = await StaticKeyStore.fromConfig(config);
+
+    const key: AnyJWK = {
+      use: 'sig',
+      alg: 'ES256',
+      kid: '1',
+      kty: '1',
+    };
+    expect(() => staticKeyStore.addKey(key)).toThrow(
+      'Cannot add keys to the static key store',
+    );
+  });
+
+  it('should not allow users to remove keys', async () => {
+    const staticKeyStore = await StaticKeyStore.fromConfig(config);
+    expect(() => staticKeyStore.removeKeys(['1'])).toThrow(
+      'Cannot remove keys from the static key store',
+    );
+  });
+});

plugins/auth-backend/src/identity/StaticKeyStore.ts

@@ -0,0 +1,178 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { AnyJWK, KeyStore, StoredKey } from './types';
+import { exportJWK, importPKCS8, importSPKI, JWK } from 'jose';
+import { KeyLike } from 'jose/dist/types/types';
+import { promises as fs } from 'fs';
+import { Config } from '@backstage/config';
+
+export type KeyPair = {
+  publicKey: JWK;
+  privateKey: JWK;
+};
+
+export type StaticKeyConfig = {
+  publicKeyFile: string;
+  privateKeyFile: string;
+  keyId: string;
+  algorithm: string;
+};
+
+const DEFAULT_ALGORITHM = 'ES256';
+
+/**
+ * Key store that loads predefined public/private key pairs from disk
+ *
+ * The private key should be represented using the PKCS#8 format,
+ * while the public key should be in the SPKI format.
+ *
+ * @remarks
+ *
+ * You can generate a public and private key pair, using
+ * openssl:
+ *
+ * Generate a private key using the ES256 algorithm
+ * ```sh
+ * openssl ecparam -name prime256v1 -genkey -out private.ec.key
+ * ```
+ * Convert it to PKCS#8 format
+ * ```sh
+ * openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private.ec.key -out private.key
+ * ```
+ * Extract the public key
+ * ```sh
+ * openssl ec -inform PEM -outform PEM -pubout -in private.key -out public.key
+ * ```
+ *
+ * Provide the paths to private.key and public.key as the respective
+ * private and public key paths in the StaticKeyStore.create(...) method.
+ */
+export class StaticKeyStore implements KeyStore {
+  private readonly keyPairs: KeyPair[];
+  private readonly createdAt: Date;
+
+  private constructor(keyPairs: KeyPair[]) {
+    if (keyPairs.length === 0) {
+      throw new Error('Should provide at least one key pair');
+    }
+
+    this.keyPairs = keyPairs;
+    this.createdAt = new Date();
+  }
+
+  public static async fromConfig(config: Config): Promise<StaticKeyStore> {
+    const keyConfigs = config
+      .getConfigArray('auth.keyStore.static.keys')
+      .map(c => {
+        const staticKeyConfig: StaticKeyConfig = {
+          publicKeyFile: c.getString('publicKeyFile'),
+          privateKeyFile: c.getString('privateKeyFile'),
+          keyId: c.getString('keyId'),
+          algorithm: c.getOptionalString('algorithm') ?? DEFAULT_ALGORITHM,
+        };
+
+        return staticKeyConfig;
+      });
+
+    const keyPairs = await Promise.all(
+      keyConfigs.map(async k => await this.loadKeyPair(k)),
+    );
+
+    return new StaticKeyStore(keyPairs);
+  }
+
+  addKey(_key: AnyJWK): Promise<void> {
+    throw new Error('Cannot add keys to the static key store');
+  }
+
+  listKeys(): Promise<{ items: StoredKey[] }> {
+    const keys = this.keyPairs.map(k => this.keyPairToStoredKey(k));
+    return Promise.resolve({ items: keys });
+  }
+
+  getPrivateKey(keyId: string): JWK {
+    const keyPair = this.keyPairs.find(k => k.publicKey.kid === keyId);
+    if (keyPair === undefined) {
+      throw new Error(`Could not find key with keyId: ${keyId}`);
+    }
+
+    return keyPair.privateKey;
+  }
+
+  removeKeys(_kids: string[]): Promise<void> {
+    throw new Error('Cannot remove keys from the static key store');
+  }
+
+  private keyPairToStoredKey(keyPair: KeyPair): StoredKey {
+    const publicKey = {
+      ...keyPair.publicKey,
+      use: 'sig',
+    };
+
+    return {
+      key: publicKey as AnyJWK,
+      createdAt: this.createdAt,
+    };
+  }
+
+  private static async loadKeyPair(options: StaticKeyConfig): Promise<KeyPair> {
+    const algorithm = options.algorithm;
+    const keyId = options.keyId;
+    const publicKey = await this.loadPublicKeyFromFile(
+      options.publicKeyFile,
+      keyId,
+      algorithm,
+    );
+    const privateKey = await this.loadPrivateKeyFromFile(
+      options.privateKeyFile,
+      keyId,
+      algorithm,
+    );
+
+    return { publicKey, privateKey };
+  }
+
+  private static async loadPublicKeyFromFile(
+    path: string,
+    keyId: string,
+    algorithm: string,
+  ): Promise<JWK> {
+    return this.loadKeyFromFile(path, keyId, algorithm, importSPKI);
+  }
+
+  private static async loadPrivateKeyFromFile(
+    path: string,
+    keyId: string,
+    algorithm: string,
+  ): Promise<JWK> {
+    return this.loadKeyFromFile(path, keyId, algorithm, importPKCS8);
+  }
+
+  private static async loadKeyFromFile(
+    path: string,
+    keyId: string,
+    algorithm: string,
+    importer: (content: string, algorithm: string) => Promise<KeyLike>,
+  ): Promise<JWK> {
+    const content = await fs.readFile(path, { encoding: 'utf8', flag: 'r' });
+    const key = await importer(content, algorithm);
+    const jwk = await exportJWK(key);
+    jwk.kid = keyId;
+    jwk.alg = algorithm;
+
+    return jwk;
+  }
+}

plugins/auth-backend/src/identity/StaticTokenIssuer.test.ts

@@ -0,0 +1,115 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { getVoidLogger } from '@backstage/backend-common';
+import { StaticTokenIssuer } from './StaticTokenIssuer';
+import { createLocalJWKSet, jwtVerify } from 'jose';
+import { stringifyEntityRef } from '@backstage/catalog-model';
+import { StaticKeyStore } from './StaticKeyStore';
+
+const logger = getVoidLogger();
+const entityRef = stringifyEntityRef({
+  kind: 'User',
+  namespace: 'default',
+  name: 'name',
+});
+
+describe('StaticTokenIssuer', () => {
+  it('should issue valid tokens signed by the first listed key', async () => {
+    const staticKeyStore = {
+      listKeys: () => {
+        return Promise.resolve({
+          items: [
+            {
+              createdAt: new Date(),
+              key: {
+                kty: 'EC',
+                x: 'vrJVK0vSV4LRwdUXA55pb3rruB92ZoUEY72HTvjIP9w',
+                y: 'UmyzoVoTERJPOE9Kvdf5t797FquRMxyFsNc0R0IrCmc',
+                crv: 'P-256',
+                kid: '1',
+                alg: 'ES256',
+                use: 'sig',
+              },
+            },
+            {
+              createdAt: new Date(),
+              key: {
+                kty: 'EC',
+                x: 'vrJVK0vSV4LRwdUXA55pb3rruB92ZoUEY72HTvjIP9w',
+                y: 'UmyzoVoTERJPOE9Kvdf5t797FquRMxyFsNc0R0IrCmc',
+                crv: 'P-256',
+                kid: '2',
+                alg: 'ES256',
+                use: 'sig',
+              },
+            },
+          ],
+        });
+      },
+      getPrivateKey: (kid: string) => {
+        expect(kid).toEqual('1');
+        return {
+          kty: 'EC',
+          x: 'vrJVK0vSV4LRwdUXA55pb3rruB92ZoUEY72HTvjIP9w',
+          y: 'UmyzoVoTERJPOE9Kvdf5t797FquRMxyFsNc0R0IrCmc',
+          crv: 'P-256',
+          d: 'R8Ja2ppMEgOm1KeYKpje00U1luybndt6yC263vcgeKo',
+          kid: '1',
+          alg: 'ES256',
+        };
+      },
+    };
+
+    const keyDurationSeconds = 86400;
+    const options = {
+      logger,
+      issuer: 'my-issuer',
+      sessionExpirationSeconds: keyDurationSeconds,
+    };
+    const issuer = new StaticTokenIssuer(
+      options,
+      staticKeyStore as unknown as StaticKeyStore,
+    );
+    const token = await issuer.issueToken({
+      claims: {
+        sub: entityRef,
+        ent: [entityRef],
+        'x-fancy-claim': 'my special claim',
+        aud: 'this value will be overridden',
+      },
+    });
+
+    const { keys } = await issuer.listPublicKeys();
+    const keyStore = createLocalJWKSet({ keys: keys });
+    const verifyResult = await jwtVerify(token, keyStore);
+    expect(verifyResult.protectedHeader).toEqual({
+      kid: '1',
+      alg: 'ES256',
+    });
+    expect(verifyResult.payload).toEqual({
+      iss: 'my-issuer',
+      aud: 'backstage',
+      sub: entityRef,
+      ent: [entityRef],
+      'x-fancy-claim': 'my special claim',
+      iat: expect.any(Number),
+      exp: expect.any(Number),
+    });
+    expect(verifyResult.payload.exp).toBe(
+      verifyResult.payload.iat! + keyDurationSeconds,
+    );
+  });
+});

plugins/auth-backend/src/identity/StaticTokenIssuer.ts

@@ -0,0 +1,104 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { AnyJWK, TokenIssuer, TokenParams } from './types';
+import { SignJWT, importJWK, JWK } from 'jose';
+import { parseEntityRef } from '@backstage/catalog-model';
+import { AuthenticationError } from '@backstage/errors';
+import { LoggerService } from '@backstage/backend-plugin-api';
+import { StaticKeyStore } from './StaticKeyStore';
+
+const MS_IN_S = 1000;
+
+export type Config = {
+  publicKeyFile: string;
+  privateKeyFile: string;
+  keyId: string;
+  algorithm?: string;
+};
+
+export type Options = {
+  logger: LoggerService;
+  /** Value of the issuer claim in issued tokens */
+  issuer: string;
+  /** Expiration time of the JWT in seconds */
+  sessionExpirationSeconds: number;
+};
+
+/**
+ * A token issuer that issues tokens from predefined
+ * public/private key pair stored in the static key store.
+ */
+export class StaticTokenIssuer implements TokenIssuer {
+  private readonly issuer: string;
+  private readonly logger: LoggerService;
+  private readonly keyStore: StaticKeyStore;
+  private readonly sessionExpirationSeconds: number;
+
+  public constructor(options: Options, keyStore: StaticKeyStore) {
+    this.issuer = options.issuer;
+    this.logger = options.logger;
+    this.sessionExpirationSeconds = options.sessionExpirationSeconds;
+    this.keyStore = keyStore;
+  }
+
+  public async issueToken(params: TokenParams): Promise<string> {
+    const key = await this.getSigningKey();
+
+    // TODO: code shared with TokenFactory.ts
+    const iss = this.issuer;
+    const { sub, ent, ...additionalClaims } = params.claims;
+    const aud = 'backstage';
+    const iat = Math.floor(Date.now() / MS_IN_S);
+    const exp = iat + this.sessionExpirationSeconds;
+
+    // Validate that the subject claim is a valid EntityRef
+    try {
+      parseEntityRef(sub);
+    } catch (error) {
+      throw new Error(
+        '"sub" claim provided by the auth resolver is not a valid EntityRef.',
+      );
+    }
+
+    this.logger.info(`Issuing token for ${sub}, with entities ${ent ?? []}`);
+
+    if (!key.alg) {
+      throw new AuthenticationError('No algorithm was provided in the key');
+    }
+
+    return new SignJWT({ ...additionalClaims, iss, sub, ent, aud, iat, exp })
+      .setProtectedHeader({ alg: key.alg, kid: key.kid })
+      .setIssuer(iss)
+      .setAudience(aud)
+      .setSubject(sub)
+      .setIssuedAt(iat)
+      .setExpirationTime(exp)
+      .sign(await importJWK(key));
+  }
+
+  private async getSigningKey(): Promise<JWK> {
+    const { items: keys } = await this.keyStore.listKeys();
+    if (keys.length >= 1) {
+      return this.keyStore.getPrivateKey(keys[0].key.kid);
+    }
+    throw new Error('Keystore should hold at least 1 key');
+  }
+
+  public async listPublicKeys(): Promise<{ keys: AnyJWK[] }> {
+    const { items: keys } = await this.keyStore.listKeys();
+    return { keys: keys.map(({ key }) => key) };
+  }
+}

plugins/auth-backend/src/providers/microsoft/__testUtils__/fake.test.ts

@@ -0,0 +1,90 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { FakeMicrosoftAPI } from './fake';
+
+describe('FakeMicrosoftAPI', () => {
+  const api = new FakeMicrosoftAPI();
+
+  describe('#token', () => {
+    it('exchanges auth codes', () => {
+      const { access_token } = api.token(
+        new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: api.generateAuthCode('User.Read'),
+        }),
+      );
+
+      expect(api.tokenHasScope(access_token, 'User.Read')).toBe(true);
+    });
+
+    it('supports scopes for the first requested audience only', () => {
+      const { access_token } = api.token(
+        new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: api.generateAuthCode('someaudience/somescope User.Read'),
+        }),
+      );
+
+      expect(api.tokenHasScope(access_token, 'User.Read')).toBe(false);
+    });
+
+    it('special openid scopes do not count towards the 1-audience limit', () => {
+      const { access_token } = api.token(
+        new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: api.generateAuthCode('openid offline_access User.Read'),
+        }),
+      );
+
+      expect(api.tokenHasScope(access_token, 'User.Read')).toBe(true);
+    });
+
+    it('refreshes tokens', () => {
+      const { access_token } = api.token(
+        new URLSearchParams({
+          grant_type: 'refresh_token',
+          refresh_token: api.generateRefreshToken(
+            'email openid profile User.Read',
+          ),
+        }),
+      );
+
+      expect(
+        api.tokenHasScope(access_token, 'email openid profile User.Read'),
+      ).toBe(true);
+    });
+    it('requires `openid` scope for ID token', () => {
+      const { id_token } = api.token(
+        new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: api.generateAuthCode('User.Read'),
+        }),
+      );
+
+      expect(id_token).toBeUndefined();
+    });
+    it('requires `offline_access` scope for refresh token', () => {
+      const { refresh_token } = api.token(
+        new URLSearchParams({
+          grant_type: 'authorization_code',
+          code: api.generateAuthCode('User.Read'),
+        }),
+      );
+
+      expect(refresh_token).toBeUndefined();
+    });
+  });
+});

plugins/auth-backend/src/providers/microsoft/__testUtils__/fake.ts

@@ -0,0 +1,126 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { decodeJwt } from 'jose';
+
+type Claims = { aud: string; scp: string };
+
+export class FakeMicrosoftAPI {
+  generateAccessToken(scope: string): string {
+    return this.tokenWithClaims(this.allClaimsForScope(scope)).access_token;
+  }
+  generateAuthCode(scope: string): string {
+    return this.encodeClaims(this.allClaimsForScope(scope));
+  }
+  generateRefreshToken(scope: string): string {
+    return this.encodeClaims(this.allClaimsForScope(scope));
+  }
+  token(formData: URLSearchParams): {
+    access_token: string;
+    scope: string;
+    refresh_token?: string;
+    id_token?: string;
+  } {
+    const scopeParameter = formData.get('scope');
+    const claims =
+      (scopeParameter && this.allClaimsForScope(scopeParameter)) ??
+      formData.get('grant_type') === 'refresh_token'
+        ? this.decodeClaims(formData.get('refresh_token')!)
+        : this.decodeClaims(formData.get('code')!);
+    return {
+      ...this.tokenWithClaims(claims),
+      ...(this.hasScope(claims, 'offline_access') && {
+        refresh_token: this.encodeClaims(claims),
+      }),
+      ...(this.hasScope(claims, 'openid') && {
+        id_token: 'header.e30K.microsoft',
+      }),
+    };
+  }
+  tokenHasScope(token: string, scope: string): boolean {
+    const { aud, scp } = decodeJwt(token);
+    return this.hasScope({ aud: aud as string, scp: scp as string }, scope);
+  }
+  private tokenWithClaims(claims: Claims): {
+    access_token: string;
+    scope: string;
+  } {
+    const filteredClaims = {
+      ...claims,
+      scp: claims.scp
+        .split(' ')
+        .filter(s => s !== 'offline_access')
+        .join(' '),
+    };
+    return {
+      access_token: `header.${Buffer.from(
+        JSON.stringify(filteredClaims),
+      ).toString('base64')}.signature`,
+      scope: this.scopeFromClaims(filteredClaims),
+    };
+  }
+  private allClaimsForScope(scope: string): Claims {
+    const scopes = scope.split(' ').map(this.parseScope);
+    const firstAudience = scopes
+      .map(({ aud }) => aud)
+      .find(aud => aud !== 'openid');
+    return {
+      aud: firstAudience ?? '00000003-0000-0000-c000-000000000000',
+      scp: scopes
+        .filter(({ aud }) => aud === 'openid' || aud === firstAudience)
+        .map(({ scp }) => scp)
+        .join(' '),
+    };
+  }
+  // auth codes and refresh tokens in this fake system are base64-encoded JSON
+  // strings of claims
+  private encodeClaims(claims: Claims): string {
+    return Buffer.from(JSON.stringify(claims)).toString('base64');
+  }
+  private decodeClaims(encoded: string): Claims {
+    return JSON.parse(Buffer.from(encoded, 'base64').toString());
+  }
+  private hasScope(claims: Claims, scope: string): boolean {
+    return this.scopeFromClaims(claims).includes(scope);
+  }
+  private parseScope(s: string): Claims {
+    if (s.includes('/')) {
+      const [aud, scp] = s.split('/');
+      return { aud, scp };
+    }
+    switch (s) {
+      case 'email':
+      case 'openid':
+      case 'offline_access':
+      case 'profile': {
+        return { aud: 'openid', scp: s };
+      }
+      default:
+        return { aud: '00000003-0000-0000-c000-000000000000', scp: s };
+    }
+  }
+  private scopeFromClaims(claims: Claims): string {
+    return claims.scp
+      .split(' ')
+      .map(this.parseScope)
+      .map(({ aud, scp }) =>
+        aud === 'openid' ||
+        claims.aud === '00000003-0000-0000-c000-000000000000'
+          ? scp
+          : `${claims.aud}/${scp}`,
+      )
+      .join(' ');
+  }
+}

plugins/auth-backend/src/providers/microsoft/provider.test.ts

@@ -0,0 +1,450 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { microsoft } from './provider';
+import { getVoidLogger } from '@backstage/backend-common';
+import { setupRequestMockHandlers } from '@backstage/backend-test-utils';
+import { ConfigReader } from '@backstage/config';
+import { rest } from 'msw';
+import { setupServer } from 'msw/node';
+import { AuthProviderRouteHandlers, AuthResolverContext } from '../types';
+import express from 'express';
+import crypto from 'crypto';
+import { FakeMicrosoftAPI } from './__testUtils__/fake';
+
+describe('MicrosoftAuthProvider', () => {
+  const nonce = 'AAAAAAAAAAAAAAAAAAAAAA=='; // 16 bytes of zeros in base64
+  const state = Buffer.from(
+    `nonce=${encodeURIComponent(nonce)}&env=development`,
+  ).toString('hex');
+  const mockBackstageToken = `header.${Buffer.from(
+    JSON.stringify({ sub: 'user:default/mock' }),
+    'utf8',
+  ).toString('base64')}.backstage`;
+
+  const server = setupServer();
+  const microsoftApi = new FakeMicrosoftAPI();
+  let provider: AuthProviderRouteHandlers;
+  let response: jest.Mocked<express.Response>;
+
+  setupRequestMockHandlers(server);
+
+  beforeEach(() => {
+    provider = microsoft.create({
+      signIn: {
+        resolver: microsoft.resolvers.emailMatchingUserEntityAnnotation(),
+      },
+    })({
+      providerId: 'microsoft',
+      baseUrl: 'http://backstage.test/api/auth',
+      appUrl: 'http://backstage.test',
+      isOriginAllowed: _ => true,
+      globalConfig: {
+        baseUrl: 'http://backstage.test/api/auth',
+        appUrl: 'http://backstage.test',
+        isOriginAllowed: _ => true,
+      },
+      config: new ConfigReader({
+        development: {
+          tenantId: 'tenantId',
+          clientId: 'clientId',
+          clientSecret: 'clientSecret',
+        },
+      }),
+      logger: getVoidLogger(),
+      resolverContext: {
+        issueToken: jest.fn(),
+        findCatalogUser: jest.fn(),
+        signInWithCatalogUser: async _ => ({
+          token: mockBackstageToken,
+        }),
+      } as AuthResolverContext,
+    }) as AuthProviderRouteHandlers;
+
+    server.use(
+      rest.post(
+        'https://login.microsoftonline.com/tenantId/oauth2/v2.0/token',
+        async (req, res, ctx) => {
+          return res(
+            ctx.json({
+              ...microsoftApi.token(new URLSearchParams(await req.text())),
+              token_type: 'Bearer',
+              expires_in: 123,
+              ext_expires_in: 123,
+            }),
+          );
+        },
+      ),
+      rest.get('https://graph.microsoft.com/v1.0/me/', (req, res, ctx) => {
+        if (
+          !microsoftApi.tokenHasScope(
+            req.headers.get('authorization')!.replace(/^Bearer /, ''),
+            'User.Read',
+          )
+        ) {
+          return res(ctx.status(403));
+        }
+        return res(
+          ctx.json({
+            id: 'conrad',
+            displayName: 'Conrad',
+            surname: 'Ribas',
+            givenName: 'Francisco',
+            mail: 'conrad@example.com',
+          }),
+        );
+      }),
+      rest.get(
+        'https://graph.microsoft.com/v1.0/me/photos/*',
+        async (req, res, ctx) => {
+          if (
+            !microsoftApi.tokenHasScope(
+              req.headers.get('authorization')!.replace(/^Bearer /, ''),
+              'User.Read',
+            )
+          ) {
+            return res(ctx.status(403));
+          }
+          const imageBuffer = new Uint8Array([104, 111, 119, 100, 121]).buffer;
+          return res(
+            ctx.set('Content-Length', imageBuffer.byteLength.toString()),
+            ctx.set('Content-Type', 'image/jpeg'),
+            ctx.body(imageBuffer),
+          );
+        },
+      ),
+    );
+    response = {
+      cookie: jest.fn(),
+      end: jest.fn(),
+      json: jest.fn(),
+      setHeader: jest.fn(),
+      status: jest.fn(),
+    } as unknown as jest.Mocked<express.Response>;
+    response.status.mockReturnValue(response);
+  });
+
+  describe('#start', () => {
+    const randomBytes = jest.spyOn(
+      crypto,
+      'randomBytes',
+    ) as unknown as jest.MockedFunction<(size: number) => Buffer>;
+
+    afterEach(() => {
+      randomBytes.mockRestore();
+    });
+
+    it('redirects to authorize URL', async () => {
+      randomBytes.mockReturnValue(Buffer.from(nonce, 'base64'));
+
+      await provider.start(
+        {
+          query: {
+            env: 'development',
+            scope: 'email openid profile User.Read',
+          },
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.setHeader).toHaveBeenCalledWith(
+        'Location',
+        'https://login.microsoftonline.com/tenantId/oauth2/v2.0/authorize' +
+          '?response_type=code' +
+          `&redirect_uri=${encodeURIComponent(
+            'http://backstage.test/api/auth/microsoft/handler/frame',
+          )}` +
+          `&scope=${encodeURIComponent('email openid profile User.Read')}` +
+          `&state=${state}` +
+          '&client_id=clientId',
+      );
+    });
+  });
+
+  describe('#handle', () => {
+    it('returns provider info and profile with photo data', async () => {
+      await provider.frameHandler(
+        {
+          query: {
+            env: 'development',
+            code: microsoftApi.generateAuthCode(
+              'email openid profile User.Read',
+            ),
+            state,
+          },
+          cookies: {
+            'microsoft-nonce': nonce,
+          },
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.end).toHaveBeenCalledWith(
+        expect.stringContaining(
+          encodeURIComponent(
+            JSON.stringify({
+              type: 'authorization_response',
+              response: {
+                providerInfo: {
+                  accessToken: microsoftApi.generateAccessToken(
+                    'email openid profile User.Read',
+                  ),
+                  scope: 'email openid profile User.Read',
+                  expiresInSeconds: 123,
+                  idToken: 'header.e30K.microsoft',
+                },
+                profile: {
+                  email: 'conrad@example.com',
+                  picture: 'data:image/jpeg;base64,aG93ZHk=',
+                  displayName: 'Conrad',
+                },
+                backstageIdentity: {
+                  token: mockBackstageToken,
+                  identity: {
+                    type: 'user',
+                    userEntityRef: 'user:default/mock',
+                    ownershipEntityRefs: [],
+                  },
+                },
+              },
+            }),
+          ),
+        ),
+      );
+    });
+
+    it('returns access token for non-microsoft graph scope', async () => {
+      await provider.frameHandler(
+        {
+          query: {
+            env: 'development',
+            code: microsoftApi.generateAuthCode('aks-audience/user.read'),
+            state,
+          },
+          cookies: {
+            'microsoft-nonce': nonce,
+          },
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.end).toHaveBeenCalledWith(
+        expect.stringContaining(
+          encodeURIComponent(
+            JSON.stringify({
+              type: 'authorization_response',
+              response: {
+                providerInfo: {
+                  accessToken: microsoftApi.generateAccessToken(
+                    'aks-audience/user.read',
+                  ),
+                  scope: 'aks-audience/user.read',
+                  expiresInSeconds: 123,
+                },
+                profile: {},
+              },
+            }),
+          ),
+        ),
+      );
+    });
+
+    it('sets refresh token', async () => {
+      await provider.frameHandler(
+        {
+          query: {
+            env: 'development',
+            code: microsoftApi.generateAuthCode(
+              'email offline_access openid profile User.Read',
+            ),
+            state,
+          },
+          cookies: {
+            'microsoft-nonce': nonce,
+          },
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.cookie).toHaveBeenCalledWith(
+        'microsoft-refresh-token',
+        microsoftApi.generateRefreshToken(
+          'email offline_access openid profile User.Read',
+        ),
+        {
+          domain: 'backstage.test',
+          httpOnly: true,
+          maxAge: 86400000000,
+          path: '/api/auth/microsoft',
+          sameSite: 'lax',
+          secure: false,
+        },
+      );
+    });
+
+    it('omits photo data when fetching it fails', async () => {
+      server.use(
+        rest.get('https://graph.microsoft.com/v1.0/me/photos/*', (_, res) =>
+          res.networkError('remote hung up'),
+        ),
+      );
+
+      await provider.frameHandler(
+        {
+          query: {
+            env: 'development',
+            code: microsoftApi.generateAuthCode(
+              'email openid profile User.Read',
+            ),
+            state,
+          },
+          cookies: {
+            'microsoft-nonce': nonce,
+          },
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.end).toHaveBeenCalledWith(
+        expect.stringContaining(
+          encodeURIComponent(
+            JSON.stringify({
+              type: 'authorization_response',
+              response: {
+                providerInfo: {
+                  accessToken: microsoftApi.generateAccessToken(
+                    'email openid profile User.Read',
+                  ),
+                  scope: 'email openid profile User.Read',
+                  expiresInSeconds: 123,
+                  idToken: 'header.e30K.microsoft',
+                },
+                profile: {
+                  email: 'conrad@example.com',
+                  displayName: 'Conrad',
+                },
+                backstageIdentity: {
+                  token: mockBackstageToken,
+                  identity: {
+                    type: 'user',
+                    userEntityRef: 'user:default/mock',
+                    ownershipEntityRefs: [],
+                  },
+                },
+              },
+            }),
+          ),
+        ),
+      );
+    });
+  });
+
+  describe('#refresh', () => {
+    it('returns provider info and profile with photo data', async () => {
+      await provider.refresh!(
+        {
+          query: {
+            env: 'development',
+            scope: 'email openid profile User.Read',
+          },
+          header: jest.fn(_ => 'XMLHttpRequest'),
+          cookies: {
+            'microsoft-refresh-token': microsoftApi.generateRefreshToken(
+              'email openid profile User.Read',
+            ),
+          },
+          get: jest.fn(),
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          providerInfo: {
+            accessToken: microsoftApi.generateAccessToken(
+              'email openid profile User.Read',
+            ),
+            scope: 'email openid profile User.Read',
+            expiresInSeconds: 123,
+            idToken: 'header.e30K.microsoft',
+          },
+          profile: {
+            email: 'conrad@example.com',
+            picture: 'data:image/jpeg;base64,aG93ZHk=',
+            displayName: 'Conrad',
+          },
+        }),
+      );
+    });
+
+    it('returns access token for non-microsoft graph scope', async () => {
+      await provider.refresh!(
+        {
+          query: {
+            env: 'development',
+            scope: 'aks-audience/user.read',
+          },
+          header: jest.fn(_ => 'XMLHttpRequest'),
+          cookies: {
+            'microsoft-refresh-token': microsoftApi.generateRefreshToken(
+              'aks-audience/user.read',
+            ),
+          },
+          get: jest.fn(),
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.json).toHaveBeenCalledWith({
+        providerInfo: {
+          accessToken: microsoftApi.generateAccessToken(
+            'aks-audience/user.read',
+          ),
+          expiresInSeconds: 123,
+          scope: 'aks-audience/user.read',
+        },
+        profile: {},
+      });
+    });
+
+    it('returns backstage identity', async () => {
+      await provider.refresh!(
+        {
+          query: {
+            env: 'development',
+            scope: 'email openid profile User.Read',
+          },
+          header: jest.fn(_ => 'XMLHttpRequest'),
+          cookies: {
+            'microsoft-refresh-token': microsoftApi.generateRefreshToken(
+              'email openid profile User.Read',
+            ),
+          },
+          get: jest.fn(),
+        } as unknown as express.Request,
+        response,
+      );
+
+      expect(response.json).toHaveBeenCalledWith(
+        expect.objectContaining({
+          backstageIdentity: expect.objectContaining({
+            token: mockBackstageToken,
+          }),
+        }),
+      );
+    });
+  });
+});

plugins/auth-backend/src/providers/microsoft/provider.ts

@@ -14,25 +14,218 @@
  * limitations under the License.
  */
 
-import { SignInResolver, AuthHandler } from '../types';
-import { OAuthResult } from '../../lib/oauth';
+import express from 'express';
+import passport from 'passport';
+import { Strategy as MicrosoftStrategy } from 'passport-microsoft';
+import {
+  encodeState,
+  OAuthAdapter,
+  OAuthEnvironmentHandler,
+  OAuthHandlers,
+  OAuthProviderOptions,
+  OAuthRefreshRequest,
+  OAuthResponse,
+  OAuthResult,
+  OAuthStartRequest,
+} from '../../lib/oauth';
+import {
+  executeFetchUserProfileStrategy,
+  executeFrameHandlerStrategy,
+  executeRedirectStrategy,
+  executeRefreshTokenStrategy,
+  makeProfileInfo,
+  PassportDoneCallback,
+} from '../../lib/passport';
+import {
+  AuthHandler,
+  OAuthStartResponse,
+  SignInResolver,
+  AuthResolverContext,
+} from '../types';
 import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
 import {
-  commonSignInResolvers,
-  createOAuthProviderFactory,
-} from '@backstage/plugin-auth-node';
-import {
-  adaptLegacyOAuthHandler,
-  adaptLegacyOAuthSignInResolver,
-  adaptOAuthSignInResolverToLegacy,
-} from '../../lib/legacy';
-import {
-  microsoftAuthenticator,
-  microsoftSignInResolvers,
-} from '@backstage/plugin-auth-backend-module-microsoft-provider';
+  commonByEmailLocalPartResolver,
+  commonByEmailResolver,
+} from '../resolvers';
+import { LoggerService } from '@backstage/backend-plugin-api';
+import fetch from 'node-fetch';
+import { decodeJwt } from 'jose';
+import { Profile as PassportProfile } from 'passport';
+import { BACKSTAGE_SESSION_EXPIRATION } from '../../lib/session';
+
+type PrivateInfo = {
+  refreshToken: string;
+};
+
+type Options = OAuthProviderOptions & {
+  signInResolver?: SignInResolver<OAuthResult>;
+  authHandler: AuthHandler<OAuthResult>;
+  logger: LoggerService;
+  resolverContext: AuthResolverContext;
+  authorizationUrl?: string;
+  tokenUrl?: string;
+};
+
+export class MicrosoftAuthProvider implements OAuthHandlers {
+  private readonly _strategy: MicrosoftStrategy;
+  private readonly signInResolver?: SignInResolver<OAuthResult>;
+  private readonly authHandler: AuthHandler<OAuthResult>;
+  private readonly logger: LoggerService;
+  private readonly resolverContext: AuthResolverContext;
+
+  constructor(options: Options) {
+    this.signInResolver = options.signInResolver;
+    this.authHandler = options.authHandler;
+    this.logger = options.logger;
+    this.resolverContext = options.resolverContext;
+
+    this._strategy = new MicrosoftStrategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        authorizationURL: options.authorizationUrl,
+        tokenURL: options.tokenUrl,
+        passReqToCallback: false,
+        skipUserProfile: (
+          accessToken: string,
+          done: (err: unknown, skip: boolean) => void,
+        ) => {
+          done(null, this.skipUserProfile(accessToken));
+        },
+      },
+      (
+        accessToken: any,
+        refreshToken: any,
+        params: any,
+        fullProfile: passport.Profile,
+        done: PassportDoneCallback<OAuthResult, PrivateInfo>,
+      ) => {
+        done(undefined, { fullProfile, accessToken, params }, { refreshToken });
+      },
+    );
+  }
+
+  private skipUserProfile = (accessToken: string): boolean => {
+    const { aud, scp } = decodeJwt(accessToken);
+    const hasGraphReadScope =
+      aud === '00000003-0000-0000-c000-000000000000' &&
+      (scp as string)
+        .split(' ')
+        .map(s => s.toLowerCase())
+        .includes('user.read');
+    return !hasGraphReadScope;
+  };
+
+  async start(req: OAuthStartRequest): Promise<OAuthStartResponse> {
+    return await executeRedirectStrategy(req, this._strategy, {
+      scope: req.scope,
+      state: encodeState(req.state),
+    });
+  }
+
+  async handler(req: express.Request) {
+    const { result, privateInfo } = await executeFrameHandlerStrategy<
+      OAuthResult,
+      PrivateInfo
+    >(req, this._strategy);
+
+    return {
+      response: await this.handleResult(result),
+      refreshToken: privateInfo.refreshToken,
+    };
+  }
+
+  async refresh(req: OAuthRefreshRequest) {
+    const { accessToken, refreshToken, params } =
+      await executeRefreshTokenStrategy(
+        this._strategy,
+        req.refreshToken,
+        req.scope,
+      );
+
+    return {
+      response: await this.handleResult({
+        params,
+        accessToken,
+        ...(!this.skipUserProfile(accessToken) && {
+          fullProfile: await executeFetchUserProfileStrategy(
+            this._strategy,
+            accessToken,
+          ),
+        }),
+      }),
+      refreshToken,
+    };
+  }
+
+  private async handleResult(result: {
+    fullProfile?: PassportProfile;
+    params: {
+      id_token?: string;
+      scope: string;
+      expires_in: number;
+    };
+    accessToken: string;
+    refreshToken?: string;
+  }): Promise<OAuthResponse> {
+    let profile = {};
+    if (result.fullProfile) {
+      const photo = await this.getUserPhoto(result.accessToken);
+      result.fullProfile.photos = photo ? [{ value: photo }] : undefined;
+      ({ profile } = await this.authHandler(
+        result as OAuthResult,
+        this.resolverContext,
+      ));
+    }
+
+    const expiresInSeconds =
+      result.params.expires_in === undefined
+        ? BACKSTAGE_SESSION_EXPIRATION
+        : Math.min(result.params.expires_in, BACKSTAGE_SESSION_EXPIRATION);
+
+    return {
+      providerInfo: {
+        accessToken: result.accessToken,
+        scope: result.params.scope,
+        expiresInSeconds,
+        ...{ idToken: result.params.id_token },
+      },
+      profile,
+      ...(result.fullProfile &&
+        this.signInResolver && {
+          backstageIdentity: await this.signInResolver(
+            { result: result as OAuthResult, profile },
+            this.resolverContext,
+          ),
+        }),
+    };
+  }
+
+  private async getUserPhoto(accessToken: string): Promise<string | undefined> {
+    try {
+      const res = await fetch(
+        'https://graph.microsoft.com/v1.0/me/photos/48x48/$value',
+        {
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+          },
+        },
+      );
+      const data = await res.buffer();
+
+      return `data:image/jpeg;base64,${data.toString('base64')}`;
+    } catch (error) {
+      this.logger.warn(
+        `Could not retrieve user profile photo from Microsoft Graph API: ${error}`,
+      );
+      return undefined;
+    }
+  }
+}
 
 /**
- * Auth provider integration for GitLab auth
+ * Auth provider integration for Microsoft auth
  *
  * @public
  */
@@ -48,21 +241,75 @@ export const microsoft = createAuthProviderIntegration({
      * Configure sign-in for this provider, without it the provider can not be used to sign users in.
      */
     signIn?: {
+      /**
+       * Maps an auth result to a Backstage identity for the user.
+       */
       resolver: SignInResolver<OAuthResult>;
     };
   }) {
-    return createOAuthProviderFactory({
-      authenticator: microsoftAuthenticator,
-      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
-      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),
-    });
+    return ({ providerId, globalConfig, config, logger, resolverContext }) =>
+      OAuthEnvironmentHandler.mapConfig(config, envConfig => {
+        const clientId = envConfig.getString('clientId');
+        const clientSecret = envConfig.getString('clientSecret');
+        const tenantId = envConfig.getString('tenantId');
+
+        const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
+        const callbackUrl =
+          customCallbackUrl ||
+          `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+        const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
+        const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
+
+        const authHandler: AuthHandler<OAuthResult> = options?.authHandler
+          ? options.authHandler
+          : async ({ fullProfile, params }) => ({
+              profile: makeProfileInfo(fullProfile ?? {}, params.id_token),
+            });
+
+        const provider = new MicrosoftAuthProvider({
+          clientId,
+          clientSecret,
+          callbackUrl,
+          authorizationUrl,
+          tokenUrl,
+          authHandler,
+          signInResolver: options?.signIn?.resolver,
+          logger,
+          resolverContext,
+        });
+
+        return OAuthAdapter.fromConfig(globalConfig, provider, {
+          providerId,
+          callbackUrl,
+        });
+      });
+  },
+  resolvers: {
+    /**
+     * Looks up the user by matching their email local part to the entity name.
+     */
+    emailLocalPartMatchingUserEntityName: () => commonByEmailLocalPartResolver,
+    /**
+     * Looks up the user by matching their email to the entity email.
+     */
+    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver,
+    /**
+     * Looks up the user by matching their email to the `microsoft.com/email` annotation.
+     */
+    emailMatchingUserEntityAnnotation(): SignInResolver<OAuthResult> {
+      return async (info, ctx) => {
+        const { profile } = info;
+
+        if (!profile.email) {
+          throw new Error('Microsoft profile contained no email');
+        }
+
+        return ctx.signInWithCatalogUser({
+          annotations: {
+            'microsoft.com/email': profile.email,
+          },
+        });
+      };
+    },
   },
-  resolvers: adaptOAuthSignInResolverToLegacy({
-    emailLocalPartMatchingUserEntityName:
-      commonSignInResolvers.emailLocalPartMatchingUserEntityName(),
-    emailMatchingUserEntityProfileEmail:
-      commonSignInResolvers.emailMatchingUserEntityProfileEmail(),
-    emailMatchingUserEntityAnnotation:
-      microsoftSignInResolvers.emailMatchingUserEntityAnnotation(),
-  }),
 });

plugins/auth-backend/src/service/router.ts

@@ -38,6 +38,9 @@ import { Minimatch } from 'minimatch';
 import { CatalogAuthResolverContext } from '../lib/resolvers';
 import { AuthDatabase } from '../database/AuthDatabase';
 import { BACKSTAGE_SESSION_EXPIRATION } from '../lib/session';
+import { TokenIssuer } from '../identity/types';
+import { StaticTokenIssuer } from '../identity/StaticTokenIssuer';
+import { StaticKeyStore } from '../identity/StaticKeyStore';
 
 /** @public */
 export type ProviderFactories = { [s: string]: AuthProviderFactory };
@@ -75,22 +78,34 @@ export async function createRouter(
   const authUrl = await discovery.getExternalBaseUrl('auth');
 
   const authDb = AuthDatabase.create(database);
+  const sessionExpirationSeconds = BACKSTAGE_SESSION_EXPIRATION;
+
   const keyStore = await KeyStores.fromConfig(config, {
     logger,
     database: authDb,
   });
-  const keyDurationSeconds = BACKSTAGE_SESSION_EXPIRATION;
-
-  const tokenIssuer = new TokenFactory({
-    issuer: authUrl,
-    keyStore,
-    keyDurationSeconds,
-    logger: logger.child({ component: 'token-factory' }),
-    algorithm:
-      tokenFactoryAlgorithm ??
-      config.getOptionalString('auth.identityTokenAlgorithm'),
-  });
 
+  let tokenIssuer: TokenIssuer;
+  if (keyStore instanceof StaticKeyStore) {
+    tokenIssuer = new StaticTokenIssuer(
+      {
+        logger: logger.child({ component: 'token-factory' }),
+        issuer: authUrl,
+        sessionExpirationSeconds: sessionExpirationSeconds,
+      },
+      keyStore as StaticKeyStore,
+    );
+  } else {
+    tokenIssuer = new TokenFactory({
+      issuer: authUrl,
+      keyStore,
+      keyDurationSeconds: sessionExpirationSeconds,
+      logger: logger.child({ component: 'token-factory' }),
+      algorithm:
+        tokenFactoryAlgorithm ??
+        config.getOptionalString('auth.identityTokenAlgorithm'),
+    });
+  }
   const secret = config.getOptionalString('auth.session.secret');
   if (secret) {
     router.use(cookieParser(secret));