paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 50 Packages Projects Releases Wiki Activity

Merge pull request #27821 from JessicaJHee/config-auth-cookie-exp-time

Browse Source 
support user configuration of auth cookie max age
This commit is contained in:
Patrik Oldsberg
2025-02-04 11:23:54 +01:00
committed by GitHub
parent d073e6bbed 0eb016b827
commit 15da9965d1
51 changed files with 245 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/auth/atlassian/provider.md
+6
View File
@@ -51,6 +51,8 @@ auth:
additionalScopes:
- 'read:jira-user'
- 'read:jira-work'
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/atlassian/provider#resolvers for more resolvers
@@ -67,6 +69,10 @@ The Atlassian provider is a structure with the following configuration keys:
**NOTE:** The scopes `offline_access`, `read:jira-work`, and `read:jira-user` are provided by default.
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/auth0/provider.md
+3
View File
@@ -44,6 +44,8 @@ auth:
audience: ${AUTH_AUTH0_AUDIENCE}
connection: ${AUTH_AUTH0_CONNECTION}
connectionScope: ${AUTH_AUTH0_CONNECTION_SCOPE}
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
session:
secret: ${AUTH_SESSION_SECRET}
```
@@ -66,6 +68,7 @@ Auth0 requires a session, so you need to give the session a secret key.
- `audience`: The intended recipients of the token.
- `connection`: Social identity provider name. To check the available social connections, please visit [Auth0 Social Connections](https://marketplace.auth0.com/features/social-connections).
- `connectionScope`: Additional scopes in the interactive token request. It should always be used in combination with the `connection` parameter.
- `sessionDuration`: Lifespan of the user session.
### Resolvers
docs/auth/aws-alb/provider.md
+6
View File
@@ -23,6 +23,8 @@ auth:
signer: 'arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/app/my-load-balancer/1234567890123456'
# this is the region where your ALB instance resides
region: 'us-west-2'
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/aws-alb/provider#resolvers for more resolvers
@@ -31,6 +33,10 @@ auth:
Ensure that you have set the signer correctly. It is also recommended that you restrict your target groups' security policy to only accept connections from that ALB.
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/bitbucket/provider.md
+6
View File
@@ -37,6 +37,8 @@ auth:
development:
clientId: ${AUTH_BITBUCKET_CLIENT_ID}
clientSecret: ${AUTH_BITBUCKET_CLIENT_SECRET}
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/bitbucket/provider#resolvers for more resolvers
@@ -49,6 +51,10 @@ The Bitbucket provider is a structure with two configuration keys:
`b59241722e3c3b4816e2`
- `clientSecret`: The Secret tied to the generated Key.
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/bitbucketServer/provider.md
+6
View File
@@ -34,6 +34,8 @@ auth:
host: bitbucket.example.org
clientId: ${AUTH_BITBUCKET_SERVER_CLIENT_ID}
clientSecret: ${AUTH_BITBUCKET_SERVER_CLIENT_SECRET}
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
```
The Bitbucket Server provider is a structure with two configuration keys:
@@ -41,6 +43,10 @@ The Bitbucket Server provider is a structure with two configuration keys:
- `clientId`: The client ID that was generated by Bitbucket, e.g. `b0f868455c15dcdff5c5fb5d173ae684`.
- `clientSecret`: The client secret tied to the generated client ID.
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/cloudflare/provider.md
+6
View File
@@ -38,6 +38,8 @@ auth:
# You can customize the authorization cookie name, by default
# CF_Authorization is used
authorizationCookieName: <MY_CAUTHORIZATION_COOKIE_NAME>
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
# This picks what sign in resolver(s) you want to use.
signIn:
resolvers:
@@ -47,6 +49,10 @@ auth:
This config section must be in place for the provider to load at all.
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/github/provider.md
+3
View File
@@ -49,6 +49,8 @@ auth:
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
## uncomment if using GitHub Enterprise
# enterpriseInstanceUrl: ${AUTH_GITHUB_ENTERPRISE_INSTANCE_URL}
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/github/provider#resolvers for more resolvers
@@ -66,6 +68,7 @@ The GitHub provider is a structure with these configuration keys:
initiating an OAuth flow, e.g.,
`https://your-intermediate-service.com/handler`. Only needed if Backstage is
not the immediate receiver (e.g., one OAuth app for many backstage instances).
- `sessionDuration` (optional): Lifespan of the user session.
- `signIn`: The configuration for the sign-in process, including the **resolvers**
that should be used to match the user from the auth provider with the user
entity in the Backstage catalog (typically a single resolver is sufficient).
docs/auth/gitlab/provider.md
+3
View File
@@ -45,6 +45,8 @@ auth:
# audience: https://gitlab.company.com
## uncomment if using a custom redirect URI
# callbackUrl: https://${BASE_URL}/api/auth/gitlab/handler/frame
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/gitlab/provider#resolvers for more resolvers
@@ -61,6 +63,7 @@ The GitLab provider is a structure with three configuration keys:
- `callbackUrl` (optional): The URL matching the Redirect URI registered when creating your GitLab OAuth App, e.g.
`https://$backstage.acme.corp/api/auth/gitlab/handler/frame`
Note: Due to a peculiarity with GitLab OAuth, ensure there is no trailing `/` after 'frame' in the URL.
- `sessionDuration` (optional): Lifespan of the user session.
### Resolvers
docs/auth/google/provider.md
+6
View File
@@ -42,6 +42,8 @@ auth:
development:
clientId: ${AUTH_GOOGLE_CLIENT_ID}
clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET}
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/google/provider#resolvers for more resolvers
@@ -54,6 +56,10 @@ The Google provider is a structure with two configuration keys:
`10023341500512-beui241gjwwkrdkr2eh7dprewj2pp1q.apps.googleusercontent.com`
- `clientSecret`: The client secret tied to the generated client ID.
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/microsoft/provider.md
+1
View File
@@ -84,6 +84,7 @@ The Microsoft provider is a structure with three mandatory configuration keys:
For more details, see [Home Realm Discovery](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy)
- `additionalScopes` (optional): List of scopes for the App Registration, to be requested in addition to the required ones.
- `skipUserProfile` (optional): If true, skips loading the user profile even if the `User.Read` scope is present. This is a performance optimization during login and can be used with resolvers that only needs the email address in `spec.profile.email` obtained when the `email` OAuth2 scope is present.
- `sessionDuration` (optional): Lifespan of the user session.
### Resolvers
docs/auth/oidc.md
+1
View File
@@ -263,6 +263,7 @@ check the App Registration you created:
basically the same thing.
- `prompt`: Recommended to use `auto` so the browser will request login to the IDP if the
user has no active session.
- `sessionDuration` (optional): Lifespan of the user session.
Note that for the time being, any change in this yaml file requires a restart of the app,
also you need to have the `session.secret` part to use OIDC (some other providers might
docs/auth/okta/provider.md
+3
View File
@@ -45,6 +45,8 @@ auth:
audience: ${AUTH_OKTA_DOMAIN}
authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional
idp: ${AUTH_OKTA_IDP} # Optional
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # Optional: supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
# https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned
additionalScopes: ${AUTH_OKTA_ADDITIONAL_SCOPES} # Optional
signIn:
@@ -62,6 +64,7 @@ The values referenced are found on the Application page on your Okta site.
`https://company.okta.com`
- `authServerId`: The authorization server ID for the Application
- `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3`
- `sessionDuration`: Lifespan of the user session.
`additionalScopes` is an optional value, a string of space separated scopes, that will be combined with the default `scope` value of `openid profile email offline_access` to adjust the `scope` sent to Okta during OAuth. This will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, setting the `additionalScopes` value to `groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app.
docs/auth/onelogin/provider.md
+6
View File
@@ -38,6 +38,8 @@ auth:
clientId: ${AUTH_ONELOGIN_CLIENT_ID}
clientSecret: ${AUTH_ONELOGIN_CLIENT_SECRET}
issuer: https://<company>.onelogin.com/oidc/2
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/onelogin/provider#resolvers for more resolvers
@@ -51,6 +53,10 @@ found on the SSO tab** for the OneLogin Application:
- `clientSecret`: The client secret
- `issuer`: The issuer URL
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use:
docs/auth/vmware-cloud/provider.md
+6
View File
@@ -47,6 +47,8 @@ auth:
development:
clientId: ${APP_ID}
organizationId: ${ORG_ID}
## uncomment to set lifespan of user session
# sessionDuration: { hours: 24 } # supports `ms` library format (e.g. '24h', '2 days'), ISO duration, "human duration" as used in code
signIn:
resolvers:
# See https://backstage.io/docs/auth/vmware-cloud/provider#resolvers for more resolvers
@@ -68,6 +70,10 @@ key for signing session cookies set by Backstage.
:::
### Optional
- `sessionDuration`: Lifespan of the user session.
### Resolvers
This provider includes several resolvers out of the box that you can use: