paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 42 Packages Projects Releases Wiki Activity

auth-backend: remove all default sign-in resolvers

Browse Source 
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
This commit is contained in:
Patrik Oldsberg
2022-03-17 15:46:59 +01:00
parent 5454a0d34f
commit 581ce7f4d4
10 changed files with 10 additions and 360 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-backend/src/providers/auth0/provider.ts
+1 -13
View File
@@ -180,18 +180,6 @@ export class Auth0AuthProvider implements OAuthHandlers {
}
}
const defaultSignInResolver: SignInResolver<OAuthResult> = async info => {
const { profile } = info;
if (!profile.email) {
throw new Error('Profile does not contain an email');
}
const id = profile.email.split('@')[0];
return { id, token: '' };
};
/** @public */
export type Auth0ProviderOptions = {
/**
@@ -244,7 +232,7 @@ export const createAuth0Provider = (
profile: makeProfileInfo(fullProfile, params.id_token),
});
const signInResolver = options?.signIn?.resolver ?? defaultSignInResolver;
const signInResolver = options?.signIn?.resolver;
const provider = new Auth0AuthProvider({
clientId,
plugins/auth-backend/src/providers/github/provider.ts
+1 -34
View File
@@ -244,29 +244,6 @@ export class GithubAuthProvider implements OAuthHandlers {
}
}
export const githubDefaultSignInResolver: SignInResolver<
GithubOAuthResult
> = async (info, ctx) => {
const { fullProfile } = info.result;
const userId = fullProfile.username || fullProfile.id;
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: userId,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id: userId, token };
};
export type GithubProviderOptions = {
/**
* The profile transformation function used to verify and convert the auth response
@@ -346,16 +323,6 @@ export const createGithubProvider = (
profile: makeProfileInfo(fullProfile),
});
const signInResolverFn =
options?.signIn?.resolver ?? githubDefaultSignInResolver;
const signInResolver: SignInResolver<GithubOAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const stateEncoder: StateEncoder =
options?.stateEncoder ??
(async (req: OAuthStartRequest): Promise<{ encodedState: string }> => {
@@ -369,7 +336,7 @@ export const createGithubProvider = (
tokenUrl,
userProfileUrl,
authorizationUrl,
signInResolver,
signInResolver: options?.signIn?.resolver,
authHandler,
tokenIssuer,
catalogIdentityClient,
plugins/auth-backend/src/providers/gitlab/provider.ts
+1 -39
View File
@@ -62,34 +62,6 @@ export type GitlabAuthProviderOptions = OAuthProviderOptions & {
logger: Logger;
};
export const gitlabDefaultSignInResolver: SignInResolver<OAuthResult> = async (
info,
ctx,
) => {
const { profile, result } = info;
let id = result.fullProfile.id;
if (profile.email) {
id = profile.email.split('@')[0];
}
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: id,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id, token };
};
export const gitlabDefaultAuthHandler: AuthHandler<OAuthResult> = async ({
fullProfile,
params,
@@ -261,23 +233,13 @@ export const createGitlabProvider = (
const authHandler: AuthHandler<OAuthResult> =
options?.authHandler ?? gitlabDefaultAuthHandler;
const signInResolverFn =
options?.signIn?.resolver ?? gitlabDefaultSignInResolver;
const signInResolver: SignInResolver<OAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const provider = new GitlabAuthProvider({
clientId,
clientSecret,
callbackUrl,
baseUrl,
authHandler,
signInResolver,
signInResolver: options?.signIn?.resolver,
catalogIdentityClient,
logger,
tokenIssuer,
plugins/auth-backend/src/providers/google/provider.ts
+1 -56
View File
@@ -14,10 +14,6 @@
* limitations under the License.
*/
import {
DEFAULT_NAMESPACE,
stringifyEntityRef,
} from '@backstage/catalog-model';
import express from 'express';
import passport from 'passport';
import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
@@ -205,47 +201,6 @@ export const googleEmailSignInResolver: SignInResolver<OAuthResult> = async (
return { id: entity.metadata.name, entity, token };
};
const googleDefaultSignInResolver: SignInResolver<OAuthResult> = async (
info,
ctx,
) => {
const { profile } = info;
if (!profile.email) {
throw new Error('Google profile contained no email');
}
let userId: string;
try {
const entity = await ctx.catalogIdentityClient.findUser({
annotations: {
'google.com/email': profile.email,
},
});
userId = entity.metadata.name;
} catch (error) {
ctx.logger.warn(
`Failed to look up user, ${error}, falling back to allowing login based on email pattern, this will probably break in the future`,
);
userId = profile.email.split('@')[0];
}
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: userId,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id: userId, token };
};
export type GoogleProviderOptions = {
/**
* The profile transformation function used to verify and convert the auth response
@@ -295,21 +250,11 @@ export const createGoogleProvider = (
profile: makeProfileInfo(fullProfile, params.id_token),
});
const signInResolverFn =
options?.signIn?.resolver ?? googleDefaultSignInResolver;
const signInResolver: SignInResolver<OAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const provider = new GoogleAuthProvider({
clientId,
clientSecret,
callbackUrl,
signInResolver,
signInResolver: options?.signIn?.resolver,
authHandler,
tokenIssuer,
catalogIdentityClient,
plugins/auth-backend/src/providers/microsoft/provider.ts
+1 -42
View File
@@ -14,10 +14,6 @@
* limitations under the License.
*/
import {
DEFAULT_NAMESPACE,
stringifyEntityRef,
} from '@backstage/catalog-model';
import express from 'express';
import passport from 'passport';
import { Strategy as MicrosoftStrategy } from 'passport-microsoft';
@@ -224,33 +220,6 @@ export const microsoftEmailSignInResolver: SignInResolver<OAuthResult> = async (
return { id: entity.metadata.name, entity, token };
};
export const microsoftDefaultSignInResolver: SignInResolver<
OAuthResult
> = async (info, ctx) => {
const { profile } = info;
if (!profile.email) {
throw new Error('Profile contained no email');
}
const userId = profile.email.split('@')[0];
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: userId,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id: userId, token };
};
export type MicrosoftProviderOptions = {
/**
* The profile transformation function used to verify and convert the auth response
@@ -304,16 +273,6 @@ export const createMicrosoftProvider = (
profile: makeProfileInfo(fullProfile, params.id_token),
});
const signInResolverFn =
options?.signIn?.resolver ?? microsoftDefaultSignInResolver;
const signInResolver: SignInResolver<OAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const provider = new MicrosoftAuthProvider({
clientId,
clientSecret,
@@ -321,7 +280,7 @@ export const createMicrosoftProvider = (
authorizationUrl,
tokenUrl,
authHandler,
signInResolver,
signInResolver: options?.signIn?.resolver,
catalogIdentityClient,
logger,
tokenIssuer,
plugins/auth-backend/src/providers/oauth2/provider.ts
+1 -43
View File
@@ -14,10 +14,6 @@
* limitations under the License.
*/
import {
DEFAULT_NAMESPACE,
stringifyEntityRef,
} from '@backstage/catalog-model';
import express from 'express';
import passport from 'passport';
import { Strategy as OAuth2Strategy } from 'passport-oauth2';
@@ -202,34 +198,6 @@ export class OAuth2AuthProvider implements OAuthHandlers {
}
}
export const oAuth2DefaultSignInResolver: SignInResolver<OAuthResult> = async (
info,
ctx,
) => {
const { profile } = info;
if (!profile.email) {
throw new Error('Profile contained no email');
}
const userId = profile.email.split('@')[0];
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: userId,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id: userId, token };
};
export type OAuth2ProviderOptions = {
authHandler?: AuthHandler<OAuthResult>;
@@ -275,23 +243,13 @@ export const createOAuth2Provider = (
profile: makeProfileInfo(fullProfile, params.id_token),
});
const signInResolverFn =
options?.signIn?.resolver ?? oAuth2DefaultSignInResolver;
const signInResolver: SignInResolver<OAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const provider = new OAuth2AuthProvider({
clientId,
clientSecret,
tokenIssuer,
catalogIdentityClient,
callbackUrl,
signInResolver,
signInResolver: options?.signIn?.resolver,
authHandler,
authorizationUrl,
tokenUrl,
plugins/auth-backend/src/providers/oidc/provider.ts
+1 -41
View File
@@ -14,10 +14,6 @@
* limitations under the License.
*/
import {
DEFAULT_NAMESPACE,
stringifyEntityRef,
} from '@backstage/catalog-model';
import express from 'express';
import {
Client,
@@ -215,34 +211,6 @@ export class OidcAuthProvider implements OAuthHandlers {
}
}
export const oidcDefaultSignInResolver: SignInResolver<OidcAuthResult> = async (
info,
ctx,
) => {
const { profile } = info;
if (!profile.email) {
throw new Error('Profile contained no email');
}
const userId = profile.email.split('@')[0];
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: userId,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id: userId, token };
};
/**
* OIDC provider callback options. An auth handler and a sign in resolver
* can be passed while creating a OIDC provider.
@@ -302,14 +270,6 @@ export const createOidcProvider = (
picture: userinfo.picture,
},
});
const signInResolverFn =
options?.signIn?.resolver ?? oidcDefaultSignInResolver;
const signInResolver: SignInResolver<OidcAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const provider = new OidcAuthProvider({
clientId,
@@ -319,7 +279,7 @@ export const createOidcProvider = (
metadataUrl,
scope,
prompt,
signInResolver,
signInResolver: options?.signIn?.resolver,
authHandler,
logger,
tokenIssuer,
plugins/auth-backend/src/providers/okta/provider.ts
+1 -44
View File
@@ -14,10 +14,6 @@
* limitations under the License.
*/
import {
DEFAULT_NAMESPACE,
stringifyEntityRef,
} from '@backstage/catalog-model';
import express from 'express';
import {
OAuthAdapter,
@@ -227,35 +223,6 @@ export const oktaEmailSignInResolver: SignInResolver<OAuthResult> = async (
return { id: entity.metadata.name, entity, token };
};
export const oktaDefaultSignInResolver: SignInResolver<OAuthResult> = async (
info,
ctx,
) => {
const { profile } = info;
if (!profile.email) {
throw new Error('Okta profile contained no email');
}
// TODO(Rugvip): Hardcoded to the local part of the email for now
const userId = profile.email.split('@')[0];
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: userId,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id: userId, token };
};
export type OktaProviderOptions = {
/**
* The profile transformation function used to verify and convert the auth response
@@ -313,23 +280,13 @@ export const createOktaProvider = (
profile: makeProfileInfo(fullProfile, params.id_token),
});
const signInResolverFn =
_options?.signIn?.resolver ?? oktaDefaultSignInResolver;
const signInResolver: SignInResolver<OAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
const provider = new OktaAuthProvider({
audience,
clientId,
clientSecret,
callbackUrl,
authHandler,
signInResolver,
signInResolver: _options?.signIn?.resolver,
tokenIssuer,
catalogIdentityClient,
logger,
plugins/auth-backend/src/providers/onelogin/provider.ts
+1 -15
View File
@@ -179,18 +179,6 @@ export class OneLoginProvider implements OAuthHandlers {
}
}
const defaultSignInResolver: SignInResolver<OAuthResult> = async info => {
const { profile } = info;
if (!profile.email) {
throw new Error('OIDC profile contained no email');
}
const id = profile.email.split('@')[0];
return { id, token: '' };
};
/** @public */
export type OneLoginProviderOptions = {
/**
@@ -243,15 +231,13 @@ export const createOneLoginProvider = (
profile: makeProfileInfo(fullProfile, params.id_token),
});
const signInResolver = options?.signIn?.resolver ?? defaultSignInResolver;
const provider = new OneLoginProvider({
clientId,
clientSecret,
callbackUrl,
issuer,
authHandler,
signInResolver,
signInResolver: options?.signIn?.resolver,
tokenIssuer,
catalogIdentityClient,
logger,
plugins/auth-backend/src/providers/saml/provider.ts
+1 -33
View File
@@ -148,28 +148,6 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
}
}
const samlDefaultSignInResolver: SignInResolver<SamlAuthResult> = async (
info,
ctx,
) => {
const id = info.result.fullProfile.nameID;
const entityRef = stringifyEntityRef({
kind: 'User',
namespace: DEFAULT_NAMESPACE,
name: id,
});
const token = await ctx.tokenIssuer.issueToken({
claims: {
sub: entityRef,
ent: [entityRef],
},
});
return { id, token };
};
type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';
/** @public */
@@ -218,16 +196,6 @@ export const createSamlProvider = (
},
});
const signInResolverFn =
options?.signIn?.resolver ?? samlDefaultSignInResolver;
const signInResolver: SignInResolver<SamlAuthResult> = info =>
signInResolverFn(info, {
catalogIdentityClient,
tokenIssuer,
logger,
});
return new SamlAuthProvider({
callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
entryPoint: config.getString('entryPoint'),
@@ -248,7 +216,7 @@ export const createSamlProvider = (
tokenIssuer,
appUrl: globalConfig.appUrl,
authHandler,
signInResolver,
signInResolver: options?.signIn?.resolver,
logger,
catalogIdentityClient,
});