From c2988744e8da93f63d9e757aa50543e58a10ca16 Mon Sep 17 00:00:00 2001 From: Vladimir Masarik Date: Mon, 14 Aug 2023 16:36:52 +0200 Subject: [PATCH 1/6] Add warning about backend APIs not having auth by default Signed-off-by: Vladimir Masarik --- .changeset/slimy-spiders-pull.md | 5 +++++ docs/auth/index.md | 2 ++ docs/permissions/getting-started.md | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 .changeset/slimy-spiders-pull.md diff --git a/.changeset/slimy-spiders-pull.md b/.changeset/slimy-spiders-pull.md new file mode 100644 index 0000000000..12bd0e23e4 --- /dev/null +++ b/.changeset/slimy-spiders-pull.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Add warning about backend APIs not having auth by default diff --git a/docs/auth/index.md b/docs/auth/index.md index b2aac47e2a..6f3250559c 100644 --- a/docs/auth/index.md +++ b/docs/auth/index.md @@ -10,6 +10,8 @@ configure Backstage to have any number of authentication providers, but only one of these will typically be used for sign-in, with the rest being used to provide access external resources. +> Note: Backstage backend APIs are by default unauthenticated. Thus, if your Backstage instance is exposed to the Internet, anyone can access information in the Backstage. If you would like to learn more, read about how to [authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md). + ## Built-in Authentication Providers Backstage comes with many common authentication providers in the core library: diff --git a/docs/permissions/getting-started.md b/docs/permissions/getting-started.md index 01a268f7ef..0d542a6502 100644 --- a/docs/permissions/getting-started.md +++ b/docs/permissions/getting-started.md @@ -36,7 +36,7 @@ Like many other parts of Backstage, the permissions framework relies on informat ## Optionally add cookie-based authentication -Asset requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. +Frontend requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. ## Integrating the permission framework with your Backstage instance From 14ae8a9497e2a0ccc7465f52b60afb1f45c4a0b9 Mon Sep 17 00:00:00 2001 From: Vladimir Masarik Date: Mon, 21 Aug 2023 19:45:25 +0200 Subject: [PATCH 2/6] Remove useless change set Signed-off-by: Vladimir Masarik --- .changeset/slimy-spiders-pull.md | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .changeset/slimy-spiders-pull.md diff --git a/.changeset/slimy-spiders-pull.md b/.changeset/slimy-spiders-pull.md deleted file mode 100644 index 12bd0e23e4..0000000000 --- a/.changeset/slimy-spiders-pull.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@backstage/plugin-auth-backend': patch ---- - -Add warning about backend APIs not having auth by default From 4c55c3b7c82e5c516abc91dad9fb27a3e2bebb2e Mon Sep 17 00:00:00 2001 From: Vladimir Masarik Date: Mon, 4 Sep 2023 18:15:10 +0200 Subject: [PATCH 3/6] Update the text Signed-off-by: Vladimir Masarik --- docs/auth/index.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/docs/auth/index.md b/docs/auth/index.md index 6f3250559c..1d796d818b 100644 --- a/docs/auth/index.md +++ b/docs/auth/index.md @@ -10,7 +10,12 @@ configure Backstage to have any number of authentication providers, but only one of these will typically be used for sign-in, with the rest being used to provide access external resources. -> Note: Backstage backend APIs are by default unauthenticated. Thus, if your Backstage instance is exposed to the Internet, anyone can access information in the Backstage. If you would like to learn more, read about how to [authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md). +> NOTE: Identity management and the Sign-In page in Backstage is NOT a method for blocking +> access for unauthorized users. The identity system only serves to provide a personalized +> experience and access to a Backstage Identity Token, which can be passed to backend plugins. +> This also means that your Backstage backend APIs are by default unauthenticated. +> Thus, if your Backstage instance is exposed to the Internet, anyone can access +> information in the Backstage. You can lear more [here](../overview/threat-model#integrator-responsibilities). ## Built-in Authentication Providers @@ -61,13 +66,6 @@ the local `auth.environment` setting will be selected. ## Sign-In Configuration -> NOTE: Identity management and the `SignInPage` in Backstage is NOT a method -> for blocking access for unauthorized users, that either requires additional -> backend implementation or a separate service like Google's Identity-Aware -> Proxy. The identity system only serves to provide a personalized experience -> and access to a Backstage Identity Token, which can be passed to backend -> plugins. - Using an authentication provider for sign-in is something you need to configure both in the frontend app, as well as the `auth` backend plugin. For information on how to configure the backend app, see [Sign-in Identities and Resolvers](./identity-resolver.md). From 675c3766c6775d748f542dced0e3e296481813cd Mon Sep 17 00:00:00 2001 From: Vladimir Masarik Date: Mon, 4 Sep 2023 18:18:02 +0200 Subject: [PATCH 4/6] Fix typo Signed-off-by: Vladimir Masarik --- docs/auth/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/auth/index.md b/docs/auth/index.md index 1d796d818b..8aebe43cac 100644 --- a/docs/auth/index.md +++ b/docs/auth/index.md @@ -15,7 +15,7 @@ access external resources. > experience and access to a Backstage Identity Token, which can be passed to backend plugins. > This also means that your Backstage backend APIs are by default unauthenticated. > Thus, if your Backstage instance is exposed to the Internet, anyone can access -> information in the Backstage. You can lear more [here](../overview/threat-model#integrator-responsibilities). +> information in the Backstage. You can learn more [here](../overview/threat-model#integrator-responsibilities). ## Built-in Authentication Providers From 2dc9cec3aaed6cf7f8ef6e1f911e68d680e4c0cf Mon Sep 17 00:00:00 2001 From: Vladimir Masarik Date: Wed, 6 Sep 2023 11:09:40 +0200 Subject: [PATCH 5/6] Fix missing file extention Signed-off-by: Vladimir Masarik --- docs/auth/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/auth/index.md b/docs/auth/index.md index 8aebe43cac..812d74ce0b 100644 --- a/docs/auth/index.md +++ b/docs/auth/index.md @@ -15,7 +15,7 @@ access external resources. > experience and access to a Backstage Identity Token, which can be passed to backend plugins. > This also means that your Backstage backend APIs are by default unauthenticated. > Thus, if your Backstage instance is exposed to the Internet, anyone can access -> information in the Backstage. You can learn more [here](../overview/threat-model#integrator-responsibilities). +> information in the Backstage. You can learn more [here](../overview/threat-model.md#integrator-responsibilities). ## Built-in Authentication Providers From beaba5f3d7bf523708f8857f01474fa005a1b6d4 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 12 Sep 2023 12:02:36 +0200 Subject: [PATCH 6/6] Update docs/permissions/getting-started.md Signed-off-by: Patrik Oldsberg --- docs/permissions/getting-started.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/permissions/getting-started.md b/docs/permissions/getting-started.md index 0d542a6502..01a268f7ef 100644 --- a/docs/permissions/getting-started.md +++ b/docs/permissions/getting-started.md @@ -36,7 +36,7 @@ Like many other parts of Backstage, the permissions framework relies on informat ## Optionally add cookie-based authentication -Frontend requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. +Asset requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. ## Integrating the permission framework with your Backstage instance