From 6edb7ba4095c03f2c6eaf7964bb42c9b675adcb5 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Fri, 4 Oct 2024 14:35:43 +0200 Subject: [PATCH] docs/auth: remove insecure sign-in resolver recommendations Signed-off-by: Patrik Oldsberg --- docs/auth/atlassian/provider.md | 4 +--- docs/auth/aws-alb/provider.md | 3 +-- docs/auth/bitbucket/provider.md | 5 +---- docs/auth/cloudflare/provider.md | 2 +- docs/auth/github/provider.md | 3 +-- docs/auth/gitlab/provider.md | 4 +--- docs/auth/google/gcp-iap-auth.md | 4 +--- docs/auth/google/provider.md | 4 +--- docs/auth/microsoft/azure-easyauth.md | 4 +--- docs/auth/microsoft/provider.md | 5 +---- docs/auth/oauth2-proxy/provider.md | 4 +--- docs/auth/oidc.md | 2 -- docs/auth/okta/provider.md | 4 +--- docs/auth/onelogin/provider.md | 4 +--- docs/auth/vmware-cloud/provider.md | 4 +--- docs/backend-system/building-backends/08-migrating.md | 2 -- 16 files changed, 14 insertions(+), 44 deletions(-) diff --git a/docs/auth/atlassian/provider.md b/docs/auth/atlassian/provider.md index 96271f04a0..f4793d4f51 100644 --- a/docs/auth/atlassian/provider.md +++ b/docs/auth/atlassian/provider.md @@ -49,9 +49,7 @@ auth: scope: ${AUTH_ATLASSIAN_SCOPES} signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/atlassian/provider#resolvers for more resolvers - resolver: usernameMatchingUserEntityName ``` diff --git a/docs/auth/aws-alb/provider.md b/docs/auth/aws-alb/provider.md index a3974c895e..8ce1eba5ab 100644 --- a/docs/auth/aws-alb/provider.md +++ b/docs/auth/aws-alb/provider.md @@ -25,9 +25,8 @@ auth: region: 'us-west-2' signIn: resolvers: - # typically you would pick one of these + # See https://backstage.io/docs/auth/aws-alb/provider#resolvers for more resolvers - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName ``` Ensure that you have set the signer correctly. It is also recommended that you restrict your target groups' security policy to only accept connections from that ALB. diff --git a/docs/auth/bitbucket/provider.md b/docs/auth/bitbucket/provider.md index 1ca35437ba..e58ad622fc 100644 --- a/docs/auth/bitbucket/provider.md +++ b/docs/auth/bitbucket/provider.md @@ -39,11 +39,8 @@ auth: clientSecret: ${AUTH_BITBUCKET_CLIENT_SECRET} signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/bitbucket/provider#resolvers for more resolvers - resolver: userIdMatchingUserEntityAnnotation - - resolver: usernameMatchingUserEntityAnnotation ``` The Bitbucket provider is a structure with two configuration keys: diff --git a/docs/auth/cloudflare/provider.md b/docs/auth/cloudflare/provider.md index a1946580a7..224a64f056 100644 --- a/docs/auth/cloudflare/provider.md +++ b/docs/auth/cloudflare/provider.md @@ -41,8 +41,8 @@ auth: # This picks what sign in resolver(s) you want to use. signIn: resolvers: + # See https://backstage.io/docs/auth/cloudflare/provider#resolvers for more resolvers - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName ``` This config section must be in place for the provider to load at all. diff --git a/docs/auth/github/provider.md b/docs/auth/github/provider.md index 76b63c6617..3b61815017 100644 --- a/docs/auth/github/provider.md +++ b/docs/auth/github/provider.md @@ -51,8 +51,7 @@ auth: # enterpriseInstanceUrl: ${AUTH_GITHUB_ENTERPRISE_INSTANCE_URL} signIn: resolvers: - # Matches the GitHub username with the Backstage user entity name. - # See https://backstage.io/docs/auth/github/provider#resolvers for more resolvers. + # See https://backstage.io/docs/auth/github/provider#resolvers for more resolvers - resolver: usernameMatchingUserEntityName ``` diff --git a/docs/auth/gitlab/provider.md b/docs/auth/gitlab/provider.md index 4f5339f5b9..5241481463 100644 --- a/docs/auth/gitlab/provider.md +++ b/docs/auth/gitlab/provider.md @@ -46,9 +46,7 @@ auth: # callbackUrl: https://${BASE_URL}/api/auth/gitlab/handler/frame signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/gitlab/provider#resolvers for more resolvers - resolver: usernameMatchingUserEntityName ``` diff --git a/docs/auth/google/gcp-iap-auth.md b/docs/auth/google/gcp-iap-auth.md index 298f212399..6fe8b56d9e 100644 --- a/docs/auth/google/gcp-iap-auth.md +++ b/docs/auth/google/gcp-iap-auth.md @@ -29,9 +29,7 @@ auth: jwtHeader: x-custom-header # Optional: Only if you are using a custom header for the IAP JWT signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/google/gcp-iap-auth#resolvers for more resolvers - resolver: emailMatchingUserEntityAnnotation ``` diff --git a/docs/auth/google/provider.md b/docs/auth/google/provider.md index b19d21d63f..109c2ddd9f 100644 --- a/docs/auth/google/provider.md +++ b/docs/auth/google/provider.md @@ -44,9 +44,7 @@ auth: clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET} signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/google/provider#resolvers for more resolvers - resolver: emailMatchingUserEntityAnnotation ``` diff --git a/docs/auth/microsoft/azure-easyauth.md b/docs/auth/microsoft/azure-easyauth.md index c2a6eab218..52c61a0d86 100644 --- a/docs/auth/microsoft/azure-easyauth.md +++ b/docs/auth/microsoft/azure-easyauth.md @@ -66,9 +66,7 @@ auth: azureEasyAuth: signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/microsoft/easy-auth#resolvers for more resolvers - resolver: idMatchingUserEntityAnnotation ``` diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md index eb4fc833fd..a786083f5f 100644 --- a/docs/auth/microsoft/provider.md +++ b/docs/auth/microsoft/provider.md @@ -69,10 +69,7 @@ auth: domainHint: ${AZURE_TENANT_ID} signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName - - resolver: emailMatchingUserEntityAnnotation + # See https://backstage.io/docs/auth/microsoft/provider#resolvers for more resolvers - resolver: userIdMatchingUserEntityAnnotation ``` diff --git a/docs/auth/oauth2-proxy/provider.md b/docs/auth/oauth2-proxy/provider.md index 84e2b307e6..2fa027e0ad 100644 --- a/docs/auth/oauth2-proxy/provider.md +++ b/docs/auth/oauth2-proxy/provider.md @@ -31,9 +31,7 @@ auth: oauth2Proxy: signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/oauth2-proxy/provider#resolvers for more resolvers - resolver: forwardedUserMatchingUserEntityName ``` diff --git a/docs/auth/oidc.md b/docs/auth/oidc.md index 4040a272b4..6d2a937320 100644 --- a/docs/auth/oidc.md +++ b/docs/auth/oidc.md @@ -156,8 +156,6 @@ auth: # ... signIn: resolvers: - # typically you would pick one of these - - resolver: emailLocalPartMatchingUserEntityName - resolver: emailMatchingUserEntityProfileEmail ``` diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index 83352aaa0d..abc6231839 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -49,9 +49,7 @@ auth: additionalScopes: ${AUTH_OKTA_ADDITIONAL_SCOPES} # Optional signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/okta/provider#resolvers for more resolvers - resolver: emailMatchingUserEntityAnnotation ``` diff --git a/docs/auth/onelogin/provider.md b/docs/auth/onelogin/provider.md index 002445a9d1..edceb1de62 100644 --- a/docs/auth/onelogin/provider.md +++ b/docs/auth/onelogin/provider.md @@ -40,9 +40,7 @@ auth: issuer: https://.onelogin.com/oidc/2 signIn: resolvers: - # typically you would pick one of these - - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName + # See https://backstage.io/docs/auth/onelogin/provider#resolvers for more resolvers - resolver: usernameMatchingUserEntityName ``` diff --git a/docs/auth/vmware-cloud/provider.md b/docs/auth/vmware-cloud/provider.md index ac2cf3ee92..a52ee98df2 100644 --- a/docs/auth/vmware-cloud/provider.md +++ b/docs/auth/vmware-cloud/provider.md @@ -49,10 +49,8 @@ auth: organizationId: ${ORG_ID} signIn: resolvers: - # typically you would pick one of these + # See https://backstage.io/docs/auth/vmware-cloud/provider#resolvers for more resolvers - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName - - resolver: vmwareCloudSignInResolvers ``` Where `APP_ID` refers to the ID retrieved when creating the OAuth App, and diff --git a/docs/backend-system/building-backends/08-migrating.md b/docs/backend-system/building-backends/08-migrating.md index 188cd4f26f..2bc111b316 100644 --- a/docs/backend-system/building-backends/08-migrating.md +++ b/docs/backend-system/building-backends/08-migrating.md @@ -884,8 +884,6 @@ auth: signIn: resolvers: - resolver: emailMatchingUserEntityProfileEmail - - resolver: emailLocalPartMatchingUserEntityName - - resolver: emailMatchingUserEntityAnnotation ``` :::note Note