From 5f1d385489409a782d9dd416565545c4bb01ad5a Mon Sep 17 00:00:00 2001 From: Timothy Deakin Date: Sun, 7 Apr 2024 05:29:51 +0100 Subject: [PATCH 1/5] feat: add support aws govcloud (us) Signed-off-by: Timothy Deakin --- .../src/helpers.test.ts | 20 ++++++++++++------- .../src/helpers.ts | 16 ++++++++++++--- 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/plugins/auth-backend-module-aws-alb-provider/src/helpers.test.ts b/plugins/auth-backend-module-aws-alb-provider/src/helpers.test.ts index cb103debb0..0bbcf9b5c1 100644 --- a/plugins/auth-backend-module-aws-alb-provider/src/helpers.test.ts +++ b/plugins/auth-backend-module-aws-alb-provider/src/helpers.test.ts @@ -26,7 +26,13 @@ import { makeProfileInfo, provisionKeyCache } from './helpers'; jest.mock('crypto'); const cryptoMock = crypto as jest.Mocked; -describe('helpers', () => { +describe.each([ + ['eu-west-1', 'https://public-keys.auth.elb.eu-west-1.amazonaws.com/kid'], + [ + 'us-gov-west-1', + 'https://s3-us-gov-west-1.amazonaws.com/aws-elb-public-keys-prod-us-gov-west-1/kid', + ], +])('helpers', (region, url) => { const server = setupServer(); setupRequestMockHandlers(server); @@ -37,7 +43,7 @@ describe('helpers', () => { jest.clearAllMocks(); server.use( http.get( - 'https://public-keys.auth.elb.eu-west-1.amazonaws.com/kid', + url, () => new HttpResponse( `-----BEGIN PUBLIC KEY----- @@ -51,12 +57,12 @@ yOlxJ2VW88mLAQGJ7HPAvOdylxZsItMnzCuqNzZvie8m/NJsOjhDncVkrw== }); it('should create a key', () => { - const getKey = provisionKeyCache('eu-west-1', nodeCache); + const getKey = provisionKeyCache(region, nodeCache); expect(getKey).toBeDefined(); }); it('should return a key from cache', async () => { - const getKey = provisionKeyCache('eu-west-1', nodeCache); + const getKey = provisionKeyCache(region, nodeCache); cryptoMock.createPublicKey.mockReturnValueOnce('key'); nodeCache.get = jest.fn().mockReturnValue('key'); @@ -67,7 +73,7 @@ yOlxJ2VW88mLAQGJ7HPAvOdylxZsItMnzCuqNzZvie8m/NJsOjhDncVkrw== }); it('should update cache if key is not found', async () => { - const getKey = provisionKeyCache('eu-west-1', nodeCache); + const getKey = provisionKeyCache(region, nodeCache); nodeCache.get = jest.fn().mockReturnValue(undefined); jest.spyOn(nodeCache, 'set'); @@ -80,7 +86,7 @@ yOlxJ2VW88mLAQGJ7HPAvOdylxZsItMnzCuqNzZvie8m/NJsOjhDncVkrw== }); it('should throw error if key is not found', async () => { - const getKey = provisionKeyCache('eu-west-1', nodeCache); + const getKey = provisionKeyCache(region, nodeCache); nodeCache.get = jest.fn().mockReturnValue(undefined); cryptoMock.createPublicKey.mockReturnValue(undefined); @@ -91,7 +97,7 @@ yOlxJ2VW88mLAQGJ7HPAvOdylxZsItMnzCuqNzZvie8m/NJsOjhDncVkrw== }); it('should throw if key is not present in request header', async () => { - const getKey = provisionKeyCache('eu-west-1', nodeCache); + const getKey = provisionKeyCache(region, nodeCache); nodeCache.get = jest.fn().mockReturnValue(undefined); diff --git a/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts b/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts index e846b2484e..1af02ce9ec 100644 --- a/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts +++ b/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts @@ -70,6 +70,17 @@ export const makeProfileInfo = ( }; }; +const getPublicKeyEndpoint = (region: string) => { + const commercialEndpoint = `https://public-keys.auth.elb.${encodeURIComponent( + region, + )}.amazonaws.com/`; + const govEndpoint = `https://s3-${encodeURIComponent( + region, + )}.amazonaws.com/aws-elb-public-keys-prod-${encodeURIComponent(region)}/`; + + return region.startsWith('us-gov') ? govEndpoint : commercialEndpoint; +}; + export const provisionKeyCache = (region: string, keyCache: NodeCache) => { return async (header: JWTHeaderParameters): Promise => { if (!header.kid) { @@ -79,10 +90,9 @@ export const provisionKeyCache = (region: string, keyCache: NodeCache) => { if (optionalCacheKey) { return crypto.createPublicKey(optionalCacheKey); } + const keyText: string = await fetch( - `https://public-keys.auth.elb.${encodeURIComponent( - region, - )}.amazonaws.com/${encodeURIComponent(header.kid)}`, + getPublicKeyEndpoint(region) + header.kid, ).then(response => response.text()); const keyValue = crypto.createPublicKey(keyText); From f286d59f036f43c5b9ee588994248b4197c2d346 Mon Sep 17 00:00:00 2001 From: Timothy Deakin Date: Sun, 7 Apr 2024 05:48:18 +0100 Subject: [PATCH 2/5] chore: add changeset Signed-off-by: Timothy Deakin --- .changeset/neat-weeks-wait.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/neat-weeks-wait.md diff --git a/.changeset/neat-weeks-wait.md b/.changeset/neat-weeks-wait.md new file mode 100644 index 0000000000..5fe26cba7c --- /dev/null +++ b/.changeset/neat-weeks-wait.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend-module-aws-alb-provider': minor +--- + +Added support for AWS GovCloud (US) regions From 0dfd660752f72abb6f922f54fa9cbb1c205999b9 Mon Sep 17 00:00:00 2001 From: Timothy Deakin Date: Mon, 8 Apr 2024 20:08:16 +0100 Subject: [PATCH 3/5] chore: update changeset change to patch as the package is < 1.0 Signed-off-by: Timothy Deakin --- .changeset/neat-weeks-wait.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/neat-weeks-wait.md b/.changeset/neat-weeks-wait.md index 5fe26cba7c..c16b91fd2f 100644 --- a/.changeset/neat-weeks-wait.md +++ b/.changeset/neat-weeks-wait.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-auth-backend-module-aws-alb-provider': minor +'@backstage/plugin-auth-backend-module-aws-alb-provider': patch --- Added support for AWS GovCloud (US) regions From 068a68c87e4d0d72c09c4a55034c6baddec22fca Mon Sep 17 00:00:00 2001 From: Timothy Deakin Date: Sat, 13 Apr 2024 17:15:10 +0100 Subject: [PATCH 4/5] refactor: cache key endpoint Signed-off-by: Timothy Deakin --- .../src/helpers.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts b/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts index 1af02ce9ec..e4bdf847c4 100644 --- a/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts +++ b/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts @@ -73,12 +73,16 @@ export const makeProfileInfo = ( const getPublicKeyEndpoint = (region: string) => { const commercialEndpoint = `https://public-keys.auth.elb.${encodeURIComponent( region, - )}.amazonaws.com/`; + )}.amazonaws.com`; const govEndpoint = `https://s3-${encodeURIComponent( region, - )}.amazonaws.com/aws-elb-public-keys-prod-${encodeURIComponent(region)}/`; + )}.amazonaws.com/aws-elb-public-keys-prod-${encodeURIComponent(region)}`; - return region.startsWith('us-gov') ? govEndpoint : commercialEndpoint; + if (region.startsWith('us-gov')) { + return govEndpoint; + } + + return commercialEndpoint; }; export const provisionKeyCache = (region: string, keyCache: NodeCache) => { @@ -92,7 +96,7 @@ export const provisionKeyCache = (region: string, keyCache: NodeCache) => { } const keyText: string = await fetch( - getPublicKeyEndpoint(region) + header.kid, + `${getPublicKeyEndpoint(region)}/${encodeURIComponent(header.kid)}`, ).then(response => response.text()); const keyValue = crypto.createPublicKey(keyText); From 4300d18da8d1281e16c0ff4a0b2331eac225265d Mon Sep 17 00:00:00 2001 From: Timothy Deakin Date: Sat, 13 Apr 2024 18:08:22 +0100 Subject: [PATCH 5/5] refactor: endpoint return Signed-off-by: Timothy Deakin --- .../src/helpers.ts | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts b/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts index e4bdf847c4..24026e2c9c 100644 --- a/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts +++ b/plugins/auth-backend-module-aws-alb-provider/src/helpers.ts @@ -71,18 +71,15 @@ export const makeProfileInfo = ( }; const getPublicKeyEndpoint = (region: string) => { - const commercialEndpoint = `https://public-keys.auth.elb.${encodeURIComponent( - region, - )}.amazonaws.com`; - const govEndpoint = `https://s3-${encodeURIComponent( - region, - )}.amazonaws.com/aws-elb-public-keys-prod-${encodeURIComponent(region)}`; - if (region.startsWith('us-gov')) { - return govEndpoint; + return `https://s3-${encodeURIComponent( + region, + )}.amazonaws.com/aws-elb-public-keys-prod-${encodeURIComponent(region)}`; } - return commercialEndpoint; + return `https://public-keys.auth.elb.${encodeURIComponent( + region, + )}.amazonaws.com`; }; export const provisionKeyCache = (region: string, keyCache: NodeCache) => {