From 468579734a6726d4f24ac0738d07177c757f9aae Mon Sep 17 00:00:00 2001
From: Joel Low <joel.low@grabtaxi.com>
Date: Fri, 8 Jan 2021 13:03:15 +0800
Subject: [PATCH] Add checks for blank cert and implement logout configs

---
 .changeset/smooth-pigs-deny.md                      | 5 +++++
 plugins/auth-backend/config.d.ts                    | 1 +
 plugins/auth-backend/src/providers/saml/provider.ts | 6 ++++++
 3 files changed, 12 insertions(+)
 create mode 100644 .changeset/smooth-pigs-deny.md

diff --git a/.changeset/smooth-pigs-deny.md b/.changeset/smooth-pigs-deny.md
new file mode 100644
index 0000000000..702c6ab2de
--- /dev/null
+++ b/.changeset/smooth-pigs-deny.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Allow blank certificates and support logout URLs in the SAML provider.
diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts
index f7e1da9b96..7c105af524 100644
--- a/plugins/auth-backend/config.d.ts
+++ b/plugins/auth-backend/config.d.ts
@@ -46,6 +46,7 @@ export interface Config {
       };
       saml?: {
         entryPoint: string;
+        logoutUrl?: string;
         issuer: string;
         cert?: string;
         privateKey?: string;
diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts
index 4cdee1da0f..45676ac43e 100644
--- a/plugins/auth-backend/src/providers/saml/provider.ts
+++ b/plugins/auth-backend/src/providers/saml/provider.ts
@@ -129,6 +129,7 @@ export const createSamlProvider: AuthProviderFactory = ({
   const opts = {
     callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
     entryPoint: config.getString('entryPoint'),
+    logoutUrl: config.getOptionalString('logoutUrl'),
     issuer: config.getString('issuer'),
     cert: config.getOptionalString('cert'),
     privateCert: config.getOptionalString('privateKey'),
@@ -142,5 +143,10 @@ export const createSamlProvider: AuthProviderFactory = ({
     appUrl: globalConfig.appUrl,
   };
 
+  // passport-saml will return an error if the `cert` key is set, and the value is empty.
+  // Since we read from config (such as environment variables) an empty string should be equal to being unset.
+  if (!opts.cert) {
+    delete opts.cert;
+  }
   return new SamlAuthProvider(opts);
 };