fixup

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.changeset/breezy-planets-sparkle.md

@@ -1,5 +1,5 @@
 ---
-'@backstage/plugin-auth-backend-module-onelogin-provider': patch
+'@backstage/plugin-auth-backend-module-onelogin-provider': minor
 ---
 
-Initial changeset to introduce onelogin provider
+Separate out the OneLogin provider into its own module

.changeset/wild-coats-doubt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Updated to use the new `@backstage/plugin-auth-backend-module-onelogin-provider` implementation

.github/vale/config/vocabularies/Backstage/accept.txt

@@ -268,6 +268,7 @@ Olausson
 Oldsberg
 onboarding
 Onboarding
+onelogin
 OpenSearch
 OpenShift
 openssl

packages/core-app-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts

@@ -76,7 +76,7 @@ export default class OneLoginAuth {
       oauthRequestApi,
       provider,
       environment,
-      defaultScopes: ['openid', 'email', 'profile'],
+      defaultScopes: ['openid', 'email', 'profile', 'offline_access'],
       scopeTransform(scopes) {
         return scopes.map(scope => {
           if (OIDC_SCOPES.has(scope)) {

plugins/auth-backend-module-onelogin-provider/src/authenticator.ts

@@ -58,7 +58,6 @@ export const oneLoginAuthenticator = createOAuthAuthenticator({
   },
 
   async start(input, helper) {
-    input.scope = 'openid email profile';
     return helper.start(input, {
       accessType: 'offline',
       prompt: 'consent',

plugins/auth-backend/package.json

@@ -57,6 +57,7 @@
     "@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "workspace:^",
     "@backstage/plugin-auth-backend-module-oidc-provider": "workspace:^",
     "@backstage/plugin-auth-backend-module-okta-provider": "workspace:^",
+    "@backstage/plugin-auth-backend-module-onelogin-provider": "workspace:^",
     "@backstage/plugin-auth-node": "workspace:^",
     "@backstage/plugin-catalog-node": "workspace:^",
     "@backstage/types": "workspace:^",

plugins/auth-backend/src/providers/onelogin/provider.ts

@@ -14,156 +14,18 @@
  * limitations under the License.
  */
 
-import { Strategy as OneLoginStrategy } from 'passport-onelogin-oauth';
-import express from 'express';
+import { oneLoginAuthenticator } from '@backstage/plugin-auth-backend-module-onelogin-provider';
 import {
-  OAuthAdapter,
-  OAuthProviderOptions,
-  OAuthHandlers,
-  OAuthResponse,
-  OAuthEnvironmentHandler,
-  OAuthStartRequest,
-  encodeState,
-  OAuthRefreshRequest,
-  OAuthResult,
-} from '../../lib/oauth';
-import passport from 'passport';
-import {
-  executeFrameHandlerStrategy,
-  executeRedirectStrategy,
-  executeRefreshTokenStrategy,
-  makeProfileInfo,
-  executeFetchUserProfileStrategy,
-  PassportDoneCallback,
-} from '../../lib/passport';
-import { OAuthStartResponse, AuthHandler } from '../types';
-import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
-import {
-  AuthResolverContext,
   SignInResolver,
+  createOAuthProviderFactory,
 } from '@backstage/plugin-auth-node';
-
-type PrivateInfo = {
-  refreshToken: string;
-};
-
-export type Options = OAuthProviderOptions & {
-  issuer: string;
-  signInResolver?: SignInResolver<OAuthResult>;
-  authHandler: AuthHandler<OAuthResult>;
-  resolverContext: AuthResolverContext;
-};
-
-export class OneLoginProvider implements OAuthHandlers {
-  private readonly _strategy: any;
-  private readonly signInResolver?: SignInResolver<OAuthResult>;
-  private readonly authHandler: AuthHandler<OAuthResult>;
-  private readonly resolverContext: AuthResolverContext;
-
-  constructor(options: Options) {
-    this.signInResolver = options.signInResolver;
-    this.authHandler = options.authHandler;
-    this.resolverContext = options.resolverContext;
-    this._strategy = new OneLoginStrategy(
-      {
-        issuer: options.issuer,
-        clientID: options.clientId,
-        clientSecret: options.clientSecret,
-        callbackURL: options.callbackUrl,
-        passReqToCallback: false,
-      },
-      (
-        accessToken: any,
-        refreshToken: any,
-        params: any,
-        fullProfile: passport.Profile,
-        done: PassportDoneCallback<OAuthResult, PrivateInfo>,
-      ) => {
-        done(
-          undefined,
-          {
-            accessToken,
-            refreshToken,
-            params,
-            fullProfile,
-          },
-          {
-            refreshToken,
-          },
-        );
-      },
-    );
-  }
-  async start(req: OAuthStartRequest): Promise<OAuthStartResponse> {
-    return await executeRedirectStrategy(req, this._strategy, {
-      accessType: 'offline',
-      prompt: 'consent',
-      scope: 'openid',
-      state: encodeState(req.state),
-    });
-  }
-
-  async handler(req: express.Request) {
-    const { result, privateInfo } = await executeFrameHandlerStrategy<
-      OAuthResult,
-      PrivateInfo
-    >(req, this._strategy);
-
-    return {
-      response: await this.handleResult(result),
-      refreshToken: privateInfo.refreshToken,
-    };
-  }
-
-  async refresh(req: OAuthRefreshRequest) {
-    const { accessToken, refreshToken, params } =
-      await executeRefreshTokenStrategy(
-        this._strategy,
-        req.refreshToken,
-        'openid',
-      );
-
-    const fullProfile = await executeFetchUserProfileStrategy(
-      this._strategy,
-      accessToken,
-    );
-
-    return {
-      response: await this.handleResult({
-        fullProfile,
-        params,
-        accessToken,
-      }),
-      refreshToken,
-    };
-  }
-
-  private async handleResult(result: OAuthResult) {
-    const { profile } = await this.authHandler(result, this.resolverContext);
-
-    const response: OAuthResponse = {
-      providerInfo: {
-        idToken: result.params.id_token,
-        accessToken: result.accessToken,
-        scope: result.params.scope,
-        expiresInSeconds: result.params.expires_in,
-      },
-      profile,
-    };
-
-    if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver(
-        {
-          result,
-          profile,
-        },
-        this.resolverContext,
-      );
-    }
-
-    return response;
-  }
-}
+import {
+  adaptLegacyOAuthHandler,
+  adaptLegacyOAuthSignInResolver,
+} from '../../lib/legacy';
+import { OAuthResult } from '../../lib/oauth';
+import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
+import { AuthHandler } from '../types';
 
 /**
  * Auth provider integration for OneLogin auth
@@ -188,36 +50,10 @@ export const onelogin = createAuthProviderIntegration({
       resolver: SignInResolver<OAuthResult>;
     };
   }) {
-    return ({ providerId, globalConfig, config, resolverContext }) =>
-      OAuthEnvironmentHandler.mapConfig(config, envConfig => {
-        const clientId = envConfig.getString('clientId');
-        const clientSecret = envConfig.getString('clientSecret');
-        const issuer = envConfig.getString('issuer');
-        const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
-        const callbackUrl =
-          customCallbackUrl ||
-          `${globalConfig.baseUrl}/${providerId}/handler/frame`;
-
-        const authHandler: AuthHandler<OAuthResult> = options?.authHandler
-          ? options.authHandler
-          : async ({ fullProfile, params }) => ({
-              profile: makeProfileInfo(fullProfile, params.id_token),
-            });
-
-        const provider = new OneLoginProvider({
-          clientId,
-          clientSecret,
-          callbackUrl,
-          issuer,
-          authHandler,
-          signInResolver: options?.signIn?.resolver,
-          resolverContext,
-        });
-
-        return OAuthAdapter.fromConfig(globalConfig, provider, {
-          providerId,
-          callbackUrl,
-        });
-      });
+    return createOAuthProviderFactory({
+      authenticator: oneLoginAuthenticator,
+      profileTransform: adaptLegacyOAuthHandler(options?.authHandler),
+      signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),
+    });
   },
 });

yarn.lock

@@ -4688,7 +4688,7 @@ __metadata:
   languageName: unknown
   linkType: soft
 
-"@backstage/plugin-auth-backend-module-onelogin-provider@workspace:plugins/auth-backend-module-onelogin-provider":
+"@backstage/plugin-auth-backend-module-onelogin-provider@workspace:^, @backstage/plugin-auth-backend-module-onelogin-provider@workspace:plugins/auth-backend-module-onelogin-provider":
   version: 0.0.0-use.local
   resolution: "@backstage/plugin-auth-backend-module-onelogin-provider@workspace:plugins/auth-backend-module-onelogin-provider"
   dependencies:
@@ -4776,6 +4776,7 @@ __metadata:
     "@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "workspace:^"
     "@backstage/plugin-auth-backend-module-oidc-provider": "workspace:^"
     "@backstage/plugin-auth-backend-module-okta-provider": "workspace:^"
+    "@backstage/plugin-auth-backend-module-onelogin-provider": "workspace:^"
     "@backstage/plugin-auth-node": "workspace:^"
     "@backstage/plugin-catalog-node": "workspace:^"
     "@backstage/types": "workspace:^"