From 64fe8e121344bc57833c3b87af013395c98e22f8 Mon Sep 17 00:00:00 2001 From: Joe Patterson Date: Thu, 8 Sep 2022 13:52:34 +1000 Subject: [PATCH] change auth0 passport to the correct passport-auth0 package and allow passing the audience into the auth for api Signed-off-by: Joe Patterson --- plugins/auth-backend/package.json | 2 + .../lib/passport/PassportStrategyHelper.ts | 3 +- .../src/providers/auth0/provider.ts | 14 ++++- .../src/providers/auth0/strategy.ts | 6 +- yarn.lock | 62 +++++++++++++++---- 5 files changed, 69 insertions(+), 18 deletions(-) diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index 4537b9e5db..35e6f86f2c 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -62,6 +62,7 @@ "node-fetch": "^2.6.7", "openid-client": "^5.1.3", "passport": "^0.6.0", + "passport-auth0": "^1.4.3", "passport-bitbucket-oauth2": "^0.1.2", "passport-github2": "^0.1.12", "passport-gitlab2": "^5.0.0", @@ -81,6 +82,7 @@ "@types/cookie-parser": "^1.4.2", "@types/express-session": "^1.17.2", "@types/jwt-decode": "^3.1.0", + "@types/passport-auth0": "^1.0.5", "@types/passport-github2": "^1.2.4", "@types/passport-google-oauth20": "^2.0.3", "@types/passport-microsoft": "^0.0.0", diff --git a/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts b/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts index 16377f17f2..7589254862 100644 --- a/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts +++ b/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts @@ -91,6 +91,7 @@ export const executeRedirectStrategy = async ( export const executeFrameHandlerStrategy = async ( req: express.Request, providerStrategy: passport.Strategy, + options?: Record, ) => { return new Promise<{ result: Result; privateInfo: PrivateInfo }>( (resolve, reject) => { @@ -124,7 +125,7 @@ export const executeFrameHandlerStrategy = async ( strategy.redirect = () => { reject(new Error('Unexpected redirect')); }; - strategy.authenticate(req, {}); + strategy.authenticate(req, { ...(options ?? {}) }); }, ); }; diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts index 8e0255ebe6..7f2310ab80 100644 --- a/plugins/auth-backend/src/providers/auth0/provider.ts +++ b/plugins/auth-backend/src/providers/auth0/provider.ts @@ -43,9 +43,11 @@ import { AuthResolverContext, } from '../types'; import { createAuthProviderIntegration } from '../createAuthProviderIntegration'; +import { ExtraVerificationParams } from 'passport-auth0'; type PrivateInfo = { refreshToken: string; + extraParams: ExtraVerificationParams, }; export type Auth0AuthProviderOptions = OAuthProviderOptions & { @@ -53,6 +55,7 @@ export type Auth0AuthProviderOptions = OAuthProviderOptions & { signInResolver?: SignInResolver; authHandler: AuthHandler; resolverContext: AuthResolverContext; + audience?: string; }; export class Auth0AuthProvider implements OAuthHandlers { @@ -60,11 +63,13 @@ export class Auth0AuthProvider implements OAuthHandlers { private readonly signInResolver?: SignInResolver; private readonly authHandler: AuthHandler; private readonly resolverContext: AuthResolverContext; + private readonly audience?: string; constructor(options: Auth0AuthProviderOptions) { this.signInResolver = options.signInResolver; this.authHandler = options.authHandler; this.resolverContext = options.resolverContext; + this.audience = options.audience; this._strategy = new Auth0Strategy( { clientID: options.clientId, @@ -79,6 +84,7 @@ export class Auth0AuthProvider implements OAuthHandlers { accessToken: any, refreshToken: any, params: any, + extraParams: ExtraVerificationParams, fullProfile: passport.Profile, done: PassportDoneCallback, ) => { @@ -92,6 +98,7 @@ export class Auth0AuthProvider implements OAuthHandlers { }, { refreshToken, + extraParams }, ); }, @@ -104,6 +111,7 @@ export class Auth0AuthProvider implements OAuthHandlers { prompt: 'consent', scope: req.scope, state: encodeState(req.state), + audience: this.audience as string }); } @@ -111,7 +119,9 @@ export class Auth0AuthProvider implements OAuthHandlers { const { result, privateInfo } = await executeFrameHandlerStrategy< OAuthResult, PrivateInfo - >(req, this._strategy); + >(req, this._strategy, { + audience: this.audience as string + }); return { response: await this.handleResult(result), @@ -198,6 +208,7 @@ export const auth0 = createAuthProviderIntegration({ const clientSecret = envConfig.getString('clientSecret'); const domain = envConfig.getString('domain'); const customCallbackUrl = envConfig.getOptionalString('callbackUrl'); + const audience = envConfig.getOptionalString('audience'); const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`; @@ -218,6 +229,7 @@ export const auth0 = createAuthProviderIntegration({ authHandler, signInResolver, resolverContext, + audience, }); return OAuthAdapter.fromConfig(globalConfig, provider, { diff --git a/plugins/auth-backend/src/providers/auth0/strategy.ts b/plugins/auth-backend/src/providers/auth0/strategy.ts index bac82db0ee..bef2836ab5 100644 --- a/plugins/auth-backend/src/providers/auth0/strategy.ts +++ b/plugins/auth-backend/src/providers/auth0/strategy.ts @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -import OAuth2Strategy from 'passport-oauth2'; +import Auth0InternalStrategy from 'passport-auth0'; export interface Auth0StrategyOptionsWithRequest { clientID: string; @@ -23,10 +23,10 @@ export interface Auth0StrategyOptionsWithRequest { passReqToCallback: true; } -export default class Auth0Strategy extends OAuth2Strategy { +export default class Auth0Strategy extends Auth0InternalStrategy { constructor( options: Auth0StrategyOptionsWithRequest, - verify: OAuth2Strategy.VerifyFunctionWithRequest, + verify: Auth0InternalStrategy.VerifyFunctionWithRequest, ) { const optionsWithURLs = { ...options, diff --git a/yarn.lock b/yarn.lock index 92a44ee343..34bcd2aacb 100644 --- a/yarn.lock +++ b/yarn.lock @@ -3946,6 +3946,7 @@ __metadata: "@types/express-session": ^1.17.2 "@types/jwt-decode": ^3.1.0 "@types/passport": ^1.0.3 + "@types/passport-auth0": ^1.0.5 "@types/passport-github2": ^1.2.4 "@types/passport-google-oauth20": ^2.0.3 "@types/passport-microsoft": ^0.0.0 @@ -3972,6 +3973,7 @@ __metadata: node-fetch: ^2.6.7 openid-client: ^5.1.3 passport: ^0.6.0 + passport-auth0: ^1.4.3 passport-bitbucket-oauth2: ^0.1.2 passport-github2: ^0.1.12 passport-gitlab2: ^5.0.0 @@ -14635,6 +14637,16 @@ __metadata: languageName: node linkType: hard +"@types/passport-auth0@npm:^1.0.5": + version: 1.0.5 + resolution: "@types/passport-auth0@npm:1.0.5" + dependencies: + "@types/express": "*" + "@types/passport": "*" + checksum: b86b69a182864cae6877c0f16a1d62e24a394dc9cde8e7285a29aef89d52fbb555b899e061157bfd52420dcbccd6fd9b189155e5367a22763b0b2813cbb28354 + languageName: node + linkType: hard + "@types/passport-github2@npm:^1.2.4": version: 1.2.5 resolution: "@types/passport-github2@npm:1.2.5" @@ -16977,6 +16989,16 @@ __metadata: languageName: node linkType: hard +"axios@npm:^0.27.2": + version: 0.27.2 + resolution: "axios@npm:0.27.2" + dependencies: + follow-redirects: ^1.14.9 + form-data: ^4.0.0 + checksum: 38cb7540465fe8c4102850c4368053c21683af85c5fdf0ea619f9628abbcb59415d1e22ebc8a6390d2bbc9b58a9806c874f139767389c862ec9b772235f06854 + languageName: node + linkType: hard + "axobject-query@npm:^2.2.0": version: 2.2.0 resolution: "axobject-query@npm:2.2.0" @@ -18098,17 +18120,10 @@ __metadata: languageName: node linkType: hard -"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30001286": - version: 1.0.30001315 - resolution: "caniuse-lite@npm:1.0.30001315" - checksum: 3938596c61e4a5c6e96d1c6aecbde67b31c4c92e55a9d443b8e51e0eac64b6dd848dfac84891f75464f8d25c7e1ed6e9c9640593922b9bd360629fd433fb69e2 - languageName: node - linkType: hard - -"caniuse-lite@npm:^1.0.30001366": - version: 1.0.30001367 - resolution: "caniuse-lite@npm:1.0.30001367" - checksum: 9912aed182b8b3a834787424b56a0e71b5ecb5d2cb7235fb022227bc3a81202e8a34bebc5dc9cc504c515b4e052f825c36c2db4b0b880c10e195fe63673edfc6 +"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30001286, caniuse-lite@npm:^1.0.30001366": + version: 1.0.30001392 + resolution: "caniuse-lite@npm:1.0.30001392" + checksum: b46fdb4cd63f43e608c9378e9a4cfc1092407fccda32f13f53db8818e0e654e5b2b9e7aee76b95a1a4fd3f2c2eabd1157aef19905f2c60dfcec136b27ac5fce6 languageName: node linkType: hard @@ -23310,6 +23325,16 @@ __metadata: languageName: node linkType: hard +"follow-redirects@npm:^1.14.9": + version: 1.15.1 + resolution: "follow-redirects@npm:1.15.1" + peerDependenciesMeta: + debug: + optional: true + checksum: 6aa4e3e3cdfa3b9314801a1cd192ba756a53479d9d8cca65bf4db3a3e8834e62139245cd2f9566147c8dfe2efff1700d3e6aefd103de4004a7b99985e71dd533 + languageName: node + linkType: hard + "for-in@npm:^1.0.2": version: 1.0.2 resolution: "for-in@npm:1.0.2" @@ -32321,6 +32346,17 @@ __metadata: languageName: node linkType: hard +"passport-auth0@npm:^1.4.3": + version: 1.4.3 + resolution: "passport-auth0@npm:1.4.3" + dependencies: + axios: ^0.27.2 + passport-oauth: ^1.0.0 + passport-oauth2: ^1.6.0 + checksum: 7658f58fd24831c67c783a9b0df3946bae9e6e42f8572747f17e77a2129d58ba21917a7531a4a328119b99a2a979ee857a1107c8e22e63e55739cdc1a8d1ccbc + languageName: node + linkType: hard + "passport-bitbucket-oauth2@npm:^0.1.2": version: 0.1.2 resolution: "passport-bitbucket-oauth2@npm:0.1.2" @@ -32379,7 +32415,7 @@ __metadata: languageName: node linkType: hard -"passport-oauth2@npm:1.6.1, passport-oauth2@npm:1.x.x, passport-oauth2@npm:^1.1.2, passport-oauth2@npm:^1.4.0, passport-oauth2@npm:^1.6.1": +"passport-oauth2@npm:1.6.1, passport-oauth2@npm:1.x.x, passport-oauth2@npm:^1.1.2, passport-oauth2@npm:^1.4.0, passport-oauth2@npm:^1.6.0, passport-oauth2@npm:^1.6.1": version: 1.6.1 resolution: "passport-oauth2@npm:1.6.1" dependencies: @@ -32392,7 +32428,7 @@ __metadata: languageName: node linkType: hard -"passport-oauth@npm:1.0.0": +"passport-oauth@npm:1.0.0, passport-oauth@npm:^1.0.0": version: 1.0.0 resolution: "passport-oauth@npm:1.0.0" dependencies: