From 8f461e6043288a3f5dc459de62bf1919c81e142c Mon Sep 17 00:00:00 2001 From: Johan Haals Date: Tue, 7 Dec 2021 10:59:52 +0100 Subject: [PATCH 1/2] auth-backend(fix): Add basicAuth option to OAuth provider Signed-off-by: Johan Haals --- .changeset/clean-apples-breathe.md | 6 ++++++ .../src/providers/oauth2/provider.ts | 17 +++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) create mode 100644 .changeset/clean-apples-breathe.md diff --git a/.changeset/clean-apples-breathe.md b/.changeset/clean-apples-breathe.md new file mode 100644 index 0000000000..f946b9496a --- /dev/null +++ b/.changeset/clean-apples-breathe.md @@ -0,0 +1,6 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Fixes potential bug introduced in `0.4.10` which causes `OAuth2AuthProvider` to authenticate using credentials in both POST payload and headers. +This might break some stricter OAuth2 implementations so there is now a `basicAuth` config option that can manually be set to `true` to enable this behavior. diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts index 1160ad19c9..b7978bcf79 100644 --- a/plugins/auth-backend/src/providers/oauth2/provider.ts +++ b/plugins/auth-backend/src/providers/oauth2/provider.ts @@ -59,6 +59,7 @@ export type OAuth2AuthProviderOptions = OAuthProviderOptions & { tokenUrl: string; scope?: string; logger: Logger; + basicAuth?: boolean; }; export class OAuth2AuthProvider implements OAuthHandlers { @@ -85,12 +86,14 @@ export class OAuth2AuthProvider implements OAuthHandlers { tokenURL: options.tokenUrl, passReqToCallback: false as true, scope: options.scope, - customHeaders: { - Authorization: `Basic ${this.encodeClientCredentials( - options.clientId, - options.clientSecret, - )}`, - }, + customHeaders: options.basicAuth + ? { + Authorization: `Basic ${this.encodeClientCredentials( + options.clientId, + options.clientSecret, + )}`, + } + : undefined, }, ( accessToken: any, @@ -244,6 +247,7 @@ export const createOAuth2Provider = ( const authorizationUrl = envConfig.getString('authorizationUrl'); const tokenUrl = envConfig.getString('tokenUrl'); const scope = envConfig.getOptionalString('scope'); + const basicAuth = envConfig.getOptionalBoolean('basicAuth'); const disableRefresh = envConfig.getOptionalBoolean('disableRefresh') ?? false; @@ -280,6 +284,7 @@ export const createOAuth2Provider = ( tokenUrl, scope, logger, + basicAuth, }); return OAuthAdapter.fromConfig(globalConfig, provider, { From 13ae212d21c137e3f1138a84f01fcf51cd904945 Mon Sep 17 00:00:00 2001 From: Johan Haals Date: Tue, 7 Dec 2021 11:55:04 +0100 Subject: [PATCH 2/2] Rename option from basicAuth to includeBasicAuth Signed-off-by: Johan Haals --- .changeset/clean-apples-breathe.md | 2 +- plugins/auth-backend/src/providers/oauth2/provider.ts | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.changeset/clean-apples-breathe.md b/.changeset/clean-apples-breathe.md index f946b9496a..f3340bf8cd 100644 --- a/.changeset/clean-apples-breathe.md +++ b/.changeset/clean-apples-breathe.md @@ -3,4 +3,4 @@ --- Fixes potential bug introduced in `0.4.10` which causes `OAuth2AuthProvider` to authenticate using credentials in both POST payload and headers. -This might break some stricter OAuth2 implementations so there is now a `basicAuth` config option that can manually be set to `true` to enable this behavior. +This might break some stricter OAuth2 implementations so there is now a `includeBasicAuth` config option that can manually be set to `true` to enable this behavior. diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts index b7978bcf79..2f9c739860 100644 --- a/plugins/auth-backend/src/providers/oauth2/provider.ts +++ b/plugins/auth-backend/src/providers/oauth2/provider.ts @@ -59,7 +59,7 @@ export type OAuth2AuthProviderOptions = OAuthProviderOptions & { tokenUrl: string; scope?: string; logger: Logger; - basicAuth?: boolean; + includeBasicAuth?: boolean; }; export class OAuth2AuthProvider implements OAuthHandlers { @@ -86,7 +86,7 @@ export class OAuth2AuthProvider implements OAuthHandlers { tokenURL: options.tokenUrl, passReqToCallback: false as true, scope: options.scope, - customHeaders: options.basicAuth + customHeaders: options.includeBasicAuth ? { Authorization: `Basic ${this.encodeClientCredentials( options.clientId, @@ -247,7 +247,7 @@ export const createOAuth2Provider = ( const authorizationUrl = envConfig.getString('authorizationUrl'); const tokenUrl = envConfig.getString('tokenUrl'); const scope = envConfig.getOptionalString('scope'); - const basicAuth = envConfig.getOptionalBoolean('basicAuth'); + const includeBasicAuth = envConfig.getOptionalBoolean('includeBasicAuth'); const disableRefresh = envConfig.getOptionalBoolean('disableRefresh') ?? false; @@ -284,7 +284,7 @@ export const createOAuth2Provider = ( tokenUrl, scope, logger, - basicAuth, + includeBasicAuth, }); return OAuthAdapter.fromConfig(globalConfig, provider, {