From 3d30d36eab14f4e67f6394c61e1274e785cbbe3e Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 2 Apr 2024 16:28:58 +0200 Subject: [PATCH] backend-app-api: add initial handling of different token typ claims Co-authored-by: Camila Belo Signed-off-by: Patrik Oldsberg --- .../auth/authServiceFactory.ts | 25 +++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts index f689df7be9..6c3a80e101 100644 --- a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts @@ -27,7 +27,10 @@ import { createServiceFactory, } from '@backstage/backend-plugin-api'; import { AuthenticationError } from '@backstage/errors'; -import { IdentityApiGetIdentityRequest } from '@backstage/plugin-auth-node'; +import { + IdentityApiGetIdentityRequest, + TokenTypes, +} from '@backstage/plugin-auth-node'; import { base64url, decodeJwt } from 'jose'; /** @internal */ @@ -112,7 +115,21 @@ class DefaultAuthService implements AuthService { // allowLimitedAccess is currently ignored, since we currently always use the full user tokens async authenticate(token: string): Promise { - const { sub, aud } = decodeJwt(token); + const { typ, sub, aud } = decodeJwt(token); + + if (typ) { + switch (typ) { + case TokenTypes.user.typClaim: + return this.#authenticateFullUser(token); + case TokenTypes.limitedUser.typClaim: + throw new AuthenticationError( + 'Limited user tokens are not supported', + ); + + default: + throw new AuthenticationError("Invalid token 'typ' claim"); + } + } // Legacy service-to-service token if (sub === 'backstage-server' && !aud) { @@ -121,6 +138,10 @@ class DefaultAuthService implements AuthService { } // User Backstage token + return this.#authenticateFullUser(token); + } + + async #authenticateFullUser(token: string) { const identity = await this.identity.getIdentity({ request: { headers: { authorization: `Bearer ${token}` },