From d0ad9ebe22ec457a833912d3032815bb52d54669 Mon Sep 17 00:00:00 2001 From: elonj Date: Thu, 13 Jan 2022 17:51:25 -0500 Subject: [PATCH 1/4] auth providers will return entity ref as "sub" value Signed-off-by: elonj --- plugins/auth-backend/src/providers/bitbucket/provider.ts | 4 ++-- plugins/auth-backend/src/providers/github/provider.ts | 5 ++++- plugins/auth-backend/src/providers/gitlab/provider.ts | 2 +- plugins/auth-backend/src/providers/google/provider.ts | 2 +- plugins/auth-backend/src/providers/microsoft/provider.ts | 7 +++++-- plugins/auth-backend/src/providers/oauth2/provider.ts | 2 +- plugins/auth-backend/src/providers/okta/provider.ts | 4 ++-- 7 files changed, 16 insertions(+), 10 deletions(-) diff --git a/plugins/auth-backend/src/providers/bitbucket/provider.ts b/plugins/auth-backend/src/providers/bitbucket/provider.ts index c83a195db5..630c5c61e3 100644 --- a/plugins/auth-backend/src/providers/bitbucket/provider.ts +++ b/plugins/auth-backend/src/providers/bitbucket/provider.ts @@ -222,7 +222,7 @@ export const bitbucketUsernameSignInResolver: SignInResolver = @@ -242,7 +242,7 @@ export const bitbucketUserIdSignInResolver: SignInResolver const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: entity.metadata.name, entity, token }; + return { id: `user:default/${entity.metadata.name}`, entity, token }; }; export type BitbucketProviderOptions = { diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts index c5ccdb2d59..220ec4fcce 100644 --- a/plugins/auth-backend/src/providers/github/provider.ts +++ b/plugins/auth-backend/src/providers/github/provider.ts @@ -191,7 +191,10 @@ export const githubDefaultSignInResolver: SignInResolver = const userId = fullProfile.username || fullProfile.id; const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: userId, ent: [`user:default/${userId}`] }, + claims: { + sub: `user:default/${userId}`, + ent: [`user:default/${userId}`], + }, }); return { id: userId, token }; diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts index 28deb458d9..5454065847 100644 --- a/plugins/auth-backend/src/providers/gitlab/provider.ts +++ b/plugins/auth-backend/src/providers/gitlab/provider.ts @@ -72,7 +72,7 @@ export const gitlabDefaultSignInResolver: SignInResolver = async ( } const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: id, ent: [`user:default/${id}`] }, + claims: { sub: `user:default/${id}`, ent: [`user:default/${id}`] }, }); return { id, token }; diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts index 90e68c6f9c..11397b5102 100644 --- a/plugins/auth-backend/src/providers/google/provider.ts +++ b/plugins/auth-backend/src/providers/google/provider.ts @@ -198,7 +198,7 @@ export const googleEmailSignInResolver: SignInResolver = async ( const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: entity.metadata.name, entity, token }; + return { id: `user:default/${entity.metadata.name}`, entity, token }; }; const googleDefaultSignInResolver: SignInResolver = async ( diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts index c45e152581..c1158ba2d3 100644 --- a/plugins/auth-backend/src/providers/microsoft/provider.ts +++ b/plugins/auth-backend/src/providers/microsoft/provider.ts @@ -217,7 +217,7 @@ export const microsoftEmailSignInResolver: SignInResolver = async ( const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: entity.metadata.name, entity, token }; + return { id: `user:default/${entity.metadata.name}`, entity, token }; }; export const microsoftDefaultSignInResolver: SignInResolver = @@ -231,7 +231,10 @@ export const microsoftDefaultSignInResolver: SignInResolver = const userId = profile.email.split('@')[0]; const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: userId, ent: [`user:default/${userId}`] }, + claims: { + sub: `user:default/${userId}`, + ent: [`user:default/${userId}`], + }, }); return { id: userId, token }; diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts index 550b88b004..ec777c231b 100644 --- a/plugins/auth-backend/src/providers/oauth2/provider.ts +++ b/plugins/auth-backend/src/providers/oauth2/provider.ts @@ -211,7 +211,7 @@ export const oAuth2DefaultSignInResolver: SignInResolver = async ( const userId = profile.email.split('@')[0]; const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: userId, ent: [`user:default/${userId}`] }, + claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }, }); return { id: userId, token }; diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index a5c663ae68..31caafed14 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -219,7 +219,7 @@ export const oktaEmailSignInResolver: SignInResolver = async ( const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: entity.metadata.name, entity, token }; + return { id: `user:default/${entity.metadata.name}`, entity, token }; }; export const oktaDefaultSignInResolver: SignInResolver = async ( @@ -236,7 +236,7 @@ export const oktaDefaultSignInResolver: SignInResolver = async ( const userId = profile.email.split('@')[0]; const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: userId, ent: [`user:default/${userId}`] }, + claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }, }); return { id: userId, token }; From b7c1bb21adeb1e232fb6b43eed3c0712f9b47ef7 Mon Sep 17 00:00:00 2001 From: elonj Date: Tue, 18 Jan 2022 11:31:55 -0500 Subject: [PATCH 2/4] fixed GithubAuth tests Signed-off-by: elonj --- .../src/providers/github/provider.test.ts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/plugins/auth-backend/src/providers/github/provider.test.ts b/plugins/auth-backend/src/providers/github/provider.test.ts index b11ac7f5a1..15eeccc07c 100644 --- a/plugins/auth-backend/src/providers/github/provider.test.ts +++ b/plugins/auth-backend/src/providers/github/provider.test.ts @@ -93,7 +93,7 @@ describe('GithubAuthProvider', () => { const expected = { backstageIdentity: { id: 'jimmymarkum', - token: 'token-for-jimmymarkum', + token: 'token-for-user:default/jimmymarkum', }, providerInfo: { accessToken: '19xasczxcm9n7gacn9jdgm19me', @@ -138,7 +138,7 @@ describe('GithubAuthProvider', () => { const expected = { backstageIdentity: { id: 'jimmymarkum', - token: 'token-for-jimmymarkum', + token: 'token-for-user:default/jimmymarkum', }, providerInfo: { accessToken: '19xasczxcm9n7gacn9jdgm19me', @@ -181,7 +181,7 @@ describe('GithubAuthProvider', () => { const expected = { backstageIdentity: { id: 'jimmymarkum', - token: 'token-for-jimmymarkum', + token: 'token-for-user:default/jimmymarkum', }, providerInfo: { accessToken: '19xasczxcm9n7gacn9jdgm19me', @@ -224,7 +224,7 @@ describe('GithubAuthProvider', () => { const expected = { backstageIdentity: { id: 'daveboyle', - token: 'token-for-daveboyle', + token: 'token-for-user:default/daveboyle', }, providerInfo: { accessToken: @@ -268,7 +268,7 @@ describe('GithubAuthProvider', () => { response: { backstageIdentity: { id: 'ipd12039', - token: 'token-for-ipd12039', + token: 'token-for-user:default/ipd12039', }, providerInfo: { accessToken: 'a.b.c', @@ -322,7 +322,7 @@ describe('GithubAuthProvider', () => { response: { backstageIdentity: { id: 'mockuser', - token: 'token-for-mockuser', + token: 'token-for-user:default/mockuser', }, profile: { displayName: 'Mocked User', From 8143d941b80af24c28dd720e534b6109e534da26 Mon Sep 17 00:00:00 2001 From: elonj Date: Wed, 19 Jan 2022 09:34:23 -0500 Subject: [PATCH 3/4] ids will be name Signed-off-by: elonj --- plugins/auth-backend/src/providers/bitbucket/provider.ts | 4 ++-- plugins/auth-backend/src/providers/google/provider.ts | 2 +- plugins/auth-backend/src/providers/microsoft/provider.ts | 2 +- plugins/auth-backend/src/providers/okta/provider.ts | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/plugins/auth-backend/src/providers/bitbucket/provider.ts b/plugins/auth-backend/src/providers/bitbucket/provider.ts index 630c5c61e3..c83a195db5 100644 --- a/plugins/auth-backend/src/providers/bitbucket/provider.ts +++ b/plugins/auth-backend/src/providers/bitbucket/provider.ts @@ -222,7 +222,7 @@ export const bitbucketUsernameSignInResolver: SignInResolver = @@ -242,7 +242,7 @@ export const bitbucketUserIdSignInResolver: SignInResolver const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: `user:default/${entity.metadata.name}`, entity, token }; + return { id: entity.metadata.name, entity, token }; }; export type BitbucketProviderOptions = { diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts index 11397b5102..90e68c6f9c 100644 --- a/plugins/auth-backend/src/providers/google/provider.ts +++ b/plugins/auth-backend/src/providers/google/provider.ts @@ -198,7 +198,7 @@ export const googleEmailSignInResolver: SignInResolver = async ( const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: `user:default/${entity.metadata.name}`, entity, token }; + return { id: entity.metadata.name, entity, token }; }; const googleDefaultSignInResolver: SignInResolver = async ( diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts index c1158ba2d3..2d4a53b076 100644 --- a/plugins/auth-backend/src/providers/microsoft/provider.ts +++ b/plugins/auth-backend/src/providers/microsoft/provider.ts @@ -217,7 +217,7 @@ export const microsoftEmailSignInResolver: SignInResolver = async ( const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: `user:default/${entity.metadata.name}`, entity, token }; + return { id: entity.metadata.name, entity, token }; }; export const microsoftDefaultSignInResolver: SignInResolver = diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 31caafed14..30dd295d12 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -219,7 +219,7 @@ export const oktaEmailSignInResolver: SignInResolver = async ( const claims = getEntityClaims(entity); const token = await ctx.tokenIssuer.issueToken({ claims }); - return { id: `user:default/${entity.metadata.name}`, entity, token }; + return { id: entity.metadata.name, entity, token }; }; export const oktaDefaultSignInResolver: SignInResolver = async ( From a53d7d8143f3efd4efaf50a2ea767185c02341be Mon Sep 17 00:00:00 2001 From: elonj Date: Wed, 19 Jan 2022 09:42:35 -0500 Subject: [PATCH 4/4] generated changeset Signed-off-by: elonj --- .changeset/three-bats-provide.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/three-bats-provide.md diff --git a/.changeset/three-bats-provide.md b/.changeset/three-bats-provide.md new file mode 100644 index 0000000000..efb44a1fc8 --- /dev/null +++ b/.changeset/three-bats-provide.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': minor +--- + +Update provider subs to return full entity ref.