From 581ce7f4d4d998974fbffb405b0c432d18fda034 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Thu, 17 Mar 2022 15:46:59 +0100 Subject: [PATCH] auth-backend: remove all default sign-in resolvers Signed-off-by: Patrik Oldsberg --- .../src/providers/auth0/provider.ts | 14 +---- .../src/providers/github/provider.ts | 35 +----------- .../src/providers/gitlab/provider.ts | 40 +------------ .../src/providers/google/provider.ts | 57 +------------------ .../src/providers/microsoft/provider.ts | 43 +------------- .../src/providers/oauth2/provider.ts | 44 +------------- .../src/providers/oidc/provider.ts | 42 +------------- .../src/providers/okta/provider.ts | 45 +-------------- .../src/providers/onelogin/provider.ts | 16 +----- .../src/providers/saml/provider.ts | 34 +---------- 10 files changed, 10 insertions(+), 360 deletions(-) diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts index fbd57c0b76..cfe4110b4a 100644 --- a/plugins/auth-backend/src/providers/auth0/provider.ts +++ b/plugins/auth-backend/src/providers/auth0/provider.ts @@ -180,18 +180,6 @@ export class Auth0AuthProvider implements OAuthHandlers { } } -const defaultSignInResolver: SignInResolver = async info => { - const { profile } = info; - - if (!profile.email) { - throw new Error('Profile does not contain an email'); - } - - const id = profile.email.split('@')[0]; - - return { id, token: '' }; -}; - /** @public */ export type Auth0ProviderOptions = { /** @@ -244,7 +232,7 @@ export const createAuth0Provider = ( profile: makeProfileInfo(fullProfile, params.id_token), }); - const signInResolver = options?.signIn?.resolver ?? defaultSignInResolver; + const signInResolver = options?.signIn?.resolver; const provider = new Auth0AuthProvider({ clientId, diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts index c875f856b6..8462fa1707 100644 --- a/plugins/auth-backend/src/providers/github/provider.ts +++ b/plugins/auth-backend/src/providers/github/provider.ts @@ -244,29 +244,6 @@ export class GithubAuthProvider implements OAuthHandlers { } } -export const githubDefaultSignInResolver: SignInResolver< - GithubOAuthResult -> = async (info, ctx) => { - const { fullProfile } = info.result; - - const userId = fullProfile.username || fullProfile.id; - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: userId, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id: userId, token }; -}; - export type GithubProviderOptions = { /** * The profile transformation function used to verify and convert the auth response @@ -346,16 +323,6 @@ export const createGithubProvider = ( profile: makeProfileInfo(fullProfile), }); - const signInResolverFn = - options?.signIn?.resolver ?? githubDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const stateEncoder: StateEncoder = options?.stateEncoder ?? (async (req: OAuthStartRequest): Promise<{ encodedState: string }> => { @@ -369,7 +336,7 @@ export const createGithubProvider = ( tokenUrl, userProfileUrl, authorizationUrl, - signInResolver, + signInResolver: options?.signIn?.resolver, authHandler, tokenIssuer, catalogIdentityClient, diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts index 59f9a5a4cb..460139562c 100644 --- a/plugins/auth-backend/src/providers/gitlab/provider.ts +++ b/plugins/auth-backend/src/providers/gitlab/provider.ts @@ -62,34 +62,6 @@ export type GitlabAuthProviderOptions = OAuthProviderOptions & { logger: Logger; }; -export const gitlabDefaultSignInResolver: SignInResolver = async ( - info, - ctx, -) => { - const { profile, result } = info; - - let id = result.fullProfile.id; - - if (profile.email) { - id = profile.email.split('@')[0]; - } - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: id, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id, token }; -}; - export const gitlabDefaultAuthHandler: AuthHandler = async ({ fullProfile, params, @@ -261,23 +233,13 @@ export const createGitlabProvider = ( const authHandler: AuthHandler = options?.authHandler ?? gitlabDefaultAuthHandler; - const signInResolverFn = - options?.signIn?.resolver ?? gitlabDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const provider = new GitlabAuthProvider({ clientId, clientSecret, callbackUrl, baseUrl, authHandler, - signInResolver, + signInResolver: options?.signIn?.resolver, catalogIdentityClient, logger, tokenIssuer, diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts index e5e5698ec4..14328c9508 100644 --- a/plugins/auth-backend/src/providers/google/provider.ts +++ b/plugins/auth-backend/src/providers/google/provider.ts @@ -14,10 +14,6 @@ * limitations under the License. */ -import { - DEFAULT_NAMESPACE, - stringifyEntityRef, -} from '@backstage/catalog-model'; import express from 'express'; import passport from 'passport'; import { Strategy as GoogleStrategy } from 'passport-google-oauth20'; @@ -205,47 +201,6 @@ export const googleEmailSignInResolver: SignInResolver = async ( return { id: entity.metadata.name, entity, token }; }; -const googleDefaultSignInResolver: SignInResolver = async ( - info, - ctx, -) => { - const { profile } = info; - - if (!profile.email) { - throw new Error('Google profile contained no email'); - } - - let userId: string; - try { - const entity = await ctx.catalogIdentityClient.findUser({ - annotations: { - 'google.com/email': profile.email, - }, - }); - userId = entity.metadata.name; - } catch (error) { - ctx.logger.warn( - `Failed to look up user, ${error}, falling back to allowing login based on email pattern, this will probably break in the future`, - ); - userId = profile.email.split('@')[0]; - } - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: userId, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id: userId, token }; -}; - export type GoogleProviderOptions = { /** * The profile transformation function used to verify and convert the auth response @@ -295,21 +250,11 @@ export const createGoogleProvider = ( profile: makeProfileInfo(fullProfile, params.id_token), }); - const signInResolverFn = - options?.signIn?.resolver ?? googleDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const provider = new GoogleAuthProvider({ clientId, clientSecret, callbackUrl, - signInResolver, + signInResolver: options?.signIn?.resolver, authHandler, tokenIssuer, catalogIdentityClient, diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts index 98f94811bd..4888ca22b4 100644 --- a/plugins/auth-backend/src/providers/microsoft/provider.ts +++ b/plugins/auth-backend/src/providers/microsoft/provider.ts @@ -14,10 +14,6 @@ * limitations under the License. */ -import { - DEFAULT_NAMESPACE, - stringifyEntityRef, -} from '@backstage/catalog-model'; import express from 'express'; import passport from 'passport'; import { Strategy as MicrosoftStrategy } from 'passport-microsoft'; @@ -224,33 +220,6 @@ export const microsoftEmailSignInResolver: SignInResolver = async ( return { id: entity.metadata.name, entity, token }; }; -export const microsoftDefaultSignInResolver: SignInResolver< - OAuthResult -> = async (info, ctx) => { - const { profile } = info; - - if (!profile.email) { - throw new Error('Profile contained no email'); - } - - const userId = profile.email.split('@')[0]; - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: userId, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id: userId, token }; -}; - export type MicrosoftProviderOptions = { /** * The profile transformation function used to verify and convert the auth response @@ -304,16 +273,6 @@ export const createMicrosoftProvider = ( profile: makeProfileInfo(fullProfile, params.id_token), }); - const signInResolverFn = - options?.signIn?.resolver ?? microsoftDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const provider = new MicrosoftAuthProvider({ clientId, clientSecret, @@ -321,7 +280,7 @@ export const createMicrosoftProvider = ( authorizationUrl, tokenUrl, authHandler, - signInResolver, + signInResolver: options?.signIn?.resolver, catalogIdentityClient, logger, tokenIssuer, diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts index d09337f5ad..c91ec688c3 100644 --- a/plugins/auth-backend/src/providers/oauth2/provider.ts +++ b/plugins/auth-backend/src/providers/oauth2/provider.ts @@ -14,10 +14,6 @@ * limitations under the License. */ -import { - DEFAULT_NAMESPACE, - stringifyEntityRef, -} from '@backstage/catalog-model'; import express from 'express'; import passport from 'passport'; import { Strategy as OAuth2Strategy } from 'passport-oauth2'; @@ -202,34 +198,6 @@ export class OAuth2AuthProvider implements OAuthHandlers { } } -export const oAuth2DefaultSignInResolver: SignInResolver = async ( - info, - ctx, -) => { - const { profile } = info; - - if (!profile.email) { - throw new Error('Profile contained no email'); - } - - const userId = profile.email.split('@')[0]; - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: userId, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id: userId, token }; -}; - export type OAuth2ProviderOptions = { authHandler?: AuthHandler; @@ -275,23 +243,13 @@ export const createOAuth2Provider = ( profile: makeProfileInfo(fullProfile, params.id_token), }); - const signInResolverFn = - options?.signIn?.resolver ?? oAuth2DefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const provider = new OAuth2AuthProvider({ clientId, clientSecret, tokenIssuer, catalogIdentityClient, callbackUrl, - signInResolver, + signInResolver: options?.signIn?.resolver, authHandler, authorizationUrl, tokenUrl, diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index b4f34cd127..f79f726824 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -14,10 +14,6 @@ * limitations under the License. */ -import { - DEFAULT_NAMESPACE, - stringifyEntityRef, -} from '@backstage/catalog-model'; import express from 'express'; import { Client, @@ -215,34 +211,6 @@ export class OidcAuthProvider implements OAuthHandlers { } } -export const oidcDefaultSignInResolver: SignInResolver = async ( - info, - ctx, -) => { - const { profile } = info; - - if (!profile.email) { - throw new Error('Profile contained no email'); - } - - const userId = profile.email.split('@')[0]; - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: userId, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id: userId, token }; -}; - /** * OIDC provider callback options. An auth handler and a sign in resolver * can be passed while creating a OIDC provider. @@ -302,14 +270,6 @@ export const createOidcProvider = ( picture: userinfo.picture, }, }); - const signInResolverFn = - options?.signIn?.resolver ?? oidcDefaultSignInResolver; - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); const provider = new OidcAuthProvider({ clientId, @@ -319,7 +279,7 @@ export const createOidcProvider = ( metadataUrl, scope, prompt, - signInResolver, + signInResolver: options?.signIn?.resolver, authHandler, logger, tokenIssuer, diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 26f586c578..60c2666200 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -14,10 +14,6 @@ * limitations under the License. */ -import { - DEFAULT_NAMESPACE, - stringifyEntityRef, -} from '@backstage/catalog-model'; import express from 'express'; import { OAuthAdapter, @@ -227,35 +223,6 @@ export const oktaEmailSignInResolver: SignInResolver = async ( return { id: entity.metadata.name, entity, token }; }; -export const oktaDefaultSignInResolver: SignInResolver = async ( - info, - ctx, -) => { - const { profile } = info; - - if (!profile.email) { - throw new Error('Okta profile contained no email'); - } - - // TODO(Rugvip): Hardcoded to the local part of the email for now - const userId = profile.email.split('@')[0]; - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: userId, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id: userId, token }; -}; - export type OktaProviderOptions = { /** * The profile transformation function used to verify and convert the auth response @@ -313,23 +280,13 @@ export const createOktaProvider = ( profile: makeProfileInfo(fullProfile, params.id_token), }); - const signInResolverFn = - _options?.signIn?.resolver ?? oktaDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const provider = new OktaAuthProvider({ audience, clientId, clientSecret, callbackUrl, authHandler, - signInResolver, + signInResolver: _options?.signIn?.resolver, tokenIssuer, catalogIdentityClient, logger, diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts index e14e8548a0..8e354aeb60 100644 --- a/plugins/auth-backend/src/providers/onelogin/provider.ts +++ b/plugins/auth-backend/src/providers/onelogin/provider.ts @@ -179,18 +179,6 @@ export class OneLoginProvider implements OAuthHandlers { } } -const defaultSignInResolver: SignInResolver = async info => { - const { profile } = info; - - if (!profile.email) { - throw new Error('OIDC profile contained no email'); - } - - const id = profile.email.split('@')[0]; - - return { id, token: '' }; -}; - /** @public */ export type OneLoginProviderOptions = { /** @@ -243,15 +231,13 @@ export const createOneLoginProvider = ( profile: makeProfileInfo(fullProfile, params.id_token), }); - const signInResolver = options?.signIn?.resolver ?? defaultSignInResolver; - const provider = new OneLoginProvider({ clientId, clientSecret, callbackUrl, issuer, authHandler, - signInResolver, + signInResolver: options?.signIn?.resolver, tokenIssuer, catalogIdentityClient, logger, diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts index 4458d423ef..fd0e5606f4 100644 --- a/plugins/auth-backend/src/providers/saml/provider.ts +++ b/plugins/auth-backend/src/providers/saml/provider.ts @@ -148,28 +148,6 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers { } } -const samlDefaultSignInResolver: SignInResolver = async ( - info, - ctx, -) => { - const id = info.result.fullProfile.nameID; - - const entityRef = stringifyEntityRef({ - kind: 'User', - namespace: DEFAULT_NAMESPACE, - name: id, - }); - - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: entityRef, - ent: [entityRef], - }, - }); - - return { id, token }; -}; - type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512'; /** @public */ @@ -218,16 +196,6 @@ export const createSamlProvider = ( }, }); - const signInResolverFn = - options?.signIn?.resolver ?? samlDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - return new SamlAuthProvider({ callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`, entryPoint: config.getString('entryPoint'), @@ -248,7 +216,7 @@ export const createSamlProvider = ( tokenIssuer, appUrl: globalConfig.appUrl, authHandler, - signInResolver, + signInResolver: options?.signIn?.resolver, logger, catalogIdentityClient, });