diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts index 2c559a2dc9..5d715724bf 100644 --- a/plugins/auth-backend/src/providers/google/provider.ts +++ b/plugins/auth-backend/src/providers/google/provider.ts @@ -23,6 +23,7 @@ import { AuthProviderConfig, } from './../types'; import { postMessageResponse } from './../utils'; +import { InputError } from '@backstage/backend-common'; export class GoogleAuthProvider implements AuthProvider, AuthProviderRouteHandlers { @@ -36,9 +37,12 @@ export class GoogleAuthProvider res: express.Response, next: express.NextFunction, ) { - const scopes = req.query.scopes?.toString().split(','); + const scope = req.query.scope?.toString() ?? ''; + if (!scope) { + throw new InputError('missing scope parameter'); + } return passport.authenticate('google', { - scope: scopes, + scope, accessType: 'offline', prompt: 'consent', })(req, res, next); @@ -66,15 +70,20 @@ export class GoogleAuthProvider strategy(): passport.Strategy { return new GoogleStrategy( - { ...this.providerConfig.options, passReqToCallback: true }, + { ...this.providerConfig.options }, ( - _req: any, accessToken: any, refreshToken: any, + params: any, profile: any, cb: any, ) => { - cb(undefined, { profile, accessToken, refreshToken }); + cb(undefined, { + profile, + idToken: params.id_token, + accessToken, + refreshToken, + }); }, ); } diff --git a/plugins/auth-backend/src/providers/utils.ts b/plugins/auth-backend/src/providers/utils.ts index 4fbe66361a..7fb906ad7c 100644 --- a/plugins/auth-backend/src/providers/utils.ts +++ b/plugins/auth-backend/src/providers/utils.ts @@ -24,12 +24,16 @@ export const postMessageResponse = ( const jsonData = JSON.stringify(data); const base64Data = Buffer.from(jsonData, 'utf8').toString('base64'); + res.setHeader('Content-Type', 'text/html'); res.setHeader('X-Frame-Options', 'sameorigin'); + + // TODO: Make target app origin configurable globally res.end(`