From 71c3b7f7653301fd23c3e4f5511f770d209ced6d Mon Sep 17 00:00:00 2001 From: Alex Crome Date: Mon, 19 Feb 2024 14:38:19 +0000 Subject: [PATCH 1/5] Fix Microsoft Auth Provider when Profile not requested Ensure that the Microsoft provider passes an empty profile object down if it hasn't received/requested one from the provider. Fixes #23032. The legacy Microsoft provider did something similar to replace a null profile with an empty object. https://github.com/backstage/backstage/blob/96c4f54bf6070db12676e9af0bf75d0d479c3d72/plugins/auth-backend/src/providers/microsoft/provider.ts#L266 I guess the only question is whether we want to fix this specifically for the Microsoft provider, or should we handle a null profiles deeper in the stack (i.e. `PassportOAuthAuthenticatorHelper.defaultProfileTransform` or in `PassportHelpers.transformProfile`) Reason this didn't affect the legacy backend is that it was only recently the legacy backend Microsoft module was swapped over to use the path from the newer backend - #22208 Signed-off-by: Alex Crome --- .changeset/eight-oranges-wave.md | 5 +++++ .../src/authenticator.ts | 13 +++++++++++-- 2 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 .changeset/eight-oranges-wave.md diff --git a/.changeset/eight-oranges-wave.md b/.changeset/eight-oranges-wave.md new file mode 100644 index 0000000000..37ac485d6c --- /dev/null +++ b/.changeset/eight-oranges-wave.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend-module-microsoft-provider': patch +--- + +Fix error when microsoft token is requested without the profile scope. diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts index 1b6eb87fae..f4927b76c0 100644 --- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts @@ -16,6 +16,7 @@ import { createOAuthAuthenticator, + OAuthAuthenticatorResult, PassportOAuthAuthenticatorHelper, PassportOAuthDoneCallback, PassportProfile, @@ -25,8 +26,16 @@ import { union } from 'lodash'; /** @public */ export const microsoftAuthenticator = createOAuthAuthenticator({ - defaultProfileTransform: - PassportOAuthAuthenticatorHelper.defaultProfileTransform, + defaultProfileTransform: ( + result: OAuthAuthenticatorResult, + context, + ) => { + result.fullProfile = result.fullProfile ?? {}; + return PassportOAuthAuthenticatorHelper.defaultProfileTransform( + result, + context, + ); + }, initialize({ callbackUrl, config }) { const clientId = config.getString('clientId'); const clientSecret = config.getString('clientSecret'); From 8d77d0073390c8fb7fd7c3b3c65f5c785256319f Mon Sep 17 00:00:00 2001 From: Alex Crome Date: Mon, 19 Feb 2024 14:48:45 +0000 Subject: [PATCH 2/5] Capatalised 'Microsoft' in changeset Signed-off-by: Alex Crome --- .changeset/eight-oranges-wave.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/eight-oranges-wave.md b/.changeset/eight-oranges-wave.md index 37ac485d6c..348795447e 100644 --- a/.changeset/eight-oranges-wave.md +++ b/.changeset/eight-oranges-wave.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend-module-microsoft-provider': patch --- -Fix error when microsoft token is requested without the profile scope. +Fix error when Microsoft token is requested without the profile scope. From a0b01eda2cbd5201ae04083ceec2f94e63548dfa Mon Sep 17 00:00:00 2001 From: Alex Crome Date: Mon, 19 Feb 2024 15:07:42 +0000 Subject: [PATCH 3/5] Moved defence against null tokens into `defaultProfileTransform` to apply more broadly than just Microsoft tokens. Signed-off-by: Alex Crome --- .changeset/eight-oranges-wave.md | 2 +- .../src/authenticator.ts | 12 ++---------- .../src/oauth/PassportOAuthAuthenticatorHelper.ts | 2 +- 3 files changed, 4 insertions(+), 12 deletions(-) diff --git a/.changeset/eight-oranges-wave.md b/.changeset/eight-oranges-wave.md index 348795447e..e0618e5de0 100644 --- a/.changeset/eight-oranges-wave.md +++ b/.changeset/eight-oranges-wave.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend-module-microsoft-provider': patch --- -Fix error when Microsoft token is requested without the profile scope. +Fix error when Microsoft tokens (or any other using the `defaultProfileTransform`) are requested without the profile scope. diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts index f4927b76c0..cc8f820afd 100644 --- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts @@ -26,16 +26,8 @@ import { union } from 'lodash'; /** @public */ export const microsoftAuthenticator = createOAuthAuthenticator({ - defaultProfileTransform: ( - result: OAuthAuthenticatorResult, - context, - ) => { - result.fullProfile = result.fullProfile ?? {}; - return PassportOAuthAuthenticatorHelper.defaultProfileTransform( - result, - context, - ); - }, + defaultProfileTransform: + PassportOAuthAuthenticatorHelper.defaultProfileTransform, initialize({ callbackUrl, config }) { const clientId = config.getString('clientId'); const clientSecret = config.getString('clientSecret'); diff --git a/plugins/auth-node/src/oauth/PassportOAuthAuthenticatorHelper.ts b/plugins/auth-node/src/oauth/PassportOAuthAuthenticatorHelper.ts index 420a661da5..c03a9cb56f 100644 --- a/plugins/auth-node/src/oauth/PassportOAuthAuthenticatorHelper.ts +++ b/plugins/auth-node/src/oauth/PassportOAuthAuthenticatorHelper.ts @@ -57,7 +57,7 @@ export class PassportOAuthAuthenticatorHelper { OAuthAuthenticatorResult > = async input => ({ profile: PassportHelpers.transformProfile( - input.fullProfile, + input.fullProfile ?? {}, input.session.idToken, ), }); From 52799c9a447ef2803c826f3541b2445bbb9fd17b Mon Sep 17 00:00:00 2001 From: Alex Crome Date: Mon, 19 Feb 2024 15:21:56 +0000 Subject: [PATCH 4/5] Remove unneeded import Signed-off-by: Alex Crome --- .../auth-backend-module-microsoft-provider/src/authenticator.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts index cc8f820afd..1b6eb87fae 100644 --- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts @@ -16,7 +16,6 @@ import { createOAuthAuthenticator, - OAuthAuthenticatorResult, PassportOAuthAuthenticatorHelper, PassportOAuthDoneCallback, PassportProfile, From e1eaac41f2fc7dacfbb339df21ae1a42b3f4373c Mon Sep 17 00:00:00 2001 From: Alex Crome Date: Mon, 19 Feb 2024 19:05:54 +0000 Subject: [PATCH 5/5] Correct package name in changeset Signed-off-by: Alex Crome --- .changeset/eight-oranges-wave.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/eight-oranges-wave.md b/.changeset/eight-oranges-wave.md index e0618e5de0..cc363178c2 100644 --- a/.changeset/eight-oranges-wave.md +++ b/.changeset/eight-oranges-wave.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-auth-backend-module-microsoft-provider': patch +'@backstage/plugin-auth-node': patch --- Fix error when Microsoft tokens (or any other using the `defaultProfileTransform`) are requested without the profile scope.