From 609a95492eca878f2f76db82b0dd3af5a0dee67a Mon Sep 17 00:00:00 2001 From: ataylorme Date: Thu, 12 Oct 2023 21:11:39 -0700 Subject: [PATCH 01/11] Allow user-defined scopes for Okta auth in config yaml - Accept a new scope option during okta creation with `createAuthProviderIntegration` - Pass the user-defined `scope` as an option to `OktaAuthProvider` - Add `scope` as an option for `OktaAuthProvider` - Set `scope` in `OktaAuthProvider` to the `scope` passed as an `option` or a default of `'openid email profile offline_access'` if a user-defined option is not provided - Update the `start` and `refresh` methods to use `scope` from `OktaAuthProvider` rather than `scope` from the request Signed-off-by: ataylorme --- plugins/auth-backend/src/providers/okta/provider.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 05e0451bdb..3ebc865726 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -60,6 +60,7 @@ export type OktaAuthProviderOptions = OAuthProviderOptions & { signInResolver?: SignInResolver; authHandler: AuthHandler; resolverContext: AuthResolverContext; + scope?: string; }; export class OktaAuthProvider implements OAuthHandlers { @@ -67,6 +68,7 @@ export class OktaAuthProvider implements OAuthHandlers { private readonly signInResolver?: SignInResolver; private readonly authHandler: AuthHandler; private readonly resolverContext: AuthResolverContext; + private readonly scope: string; /** * Due to passport-okta-oauth forcing options.state = true, @@ -89,6 +91,7 @@ export class OktaAuthProvider implements OAuthHandlers { this.signInResolver = options.signInResolver; this.authHandler = options.authHandler; this.resolverContext = options.resolverContext; + this.scope = options.scope || 'openid email profile offline_access'; this.strategy = new OktaStrategy( { @@ -129,7 +132,7 @@ export class OktaAuthProvider implements OAuthHandlers { return await executeRedirectStrategy(req, this.strategy, { accessType: 'offline', prompt: 'consent', - scope: req.scope, + scope: this.scope, state: encodeState(req.state), }); } @@ -151,7 +154,7 @@ export class OktaAuthProvider implements OAuthHandlers { await executeRefreshTokenStrategy( this.strategy, req.refreshToken, - req.scope, + this.scope, ); const fullProfile = await executeFetchUserProfileStrategy( @@ -230,6 +233,7 @@ export const okta = createAuthProviderIntegration({ const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`; + const scope = envConfig.getOptionalString('scope'); // This is a safe assumption as `passport-okta-oauth` uses the audience // as the base for building the authorization, token, and user info URLs. @@ -254,6 +258,7 @@ export const okta = createAuthProviderIntegration({ authHandler, signInResolver: options?.signIn?.resolver, resolverContext, + scope, }); return OAuthAdapter.fromConfig(globalConfig, provider, { From f2fc5acca6276c135ddb8d02bd564b781dec73c6 Mon Sep 17 00:00:00 2001 From: ataylorme Date: Fri, 13 Oct 2023 05:38:13 -0700 Subject: [PATCH 02/11] Add changeset for user-defined scopes for Okta auth Signed-off-by: ataylorme --- .changeset/sharp-wombats-speak.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .changeset/sharp-wombats-speak.md diff --git a/.changeset/sharp-wombats-speak.md b/.changeset/sharp-wombats-speak.md new file mode 100644 index 0000000000..ff6a349ed8 --- /dev/null +++ b/.changeset/sharp-wombats-speak.md @@ -0,0 +1,28 @@ +--- +'@backstage/plugin-auth-backend': minor +--- + +Allow user-defined scopes for Okta auth in config yaml + +Example `app-config.yaml` excerpt + +```yml +auth: + environment: development + providers: + okta: + development: + clientId: ${AUTH_OKTA_CLIENT_ID} + clientSecret: ${AUTH_OKTA_CLIENT_SECRET} + audience: ${AUTH_OKTA_DOMAIN} + authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional + idp: ${AUTH_OKTA_IDP} # Optional + # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned + scope: openid profile email offline_access groups # Optional +``` + +- Accept a new scope option during okta creation with `createAuthProviderIntegration` +- Pass the user-defined `scope` as an option to `OktaAuthProvider` +- Add `scope` as an option for `OktaAuthProvider` +- Set `scope` in `OktaAuthProvider` to the `scope` passed as an `option` or a default of `'openid email profile offline_access'` if a user-defined option is not provided +- Update the `start` and `refresh` methods to use `scope` from `OktaAuthProvider` rather than `scope` from the request From d08e82d8b4458b53a0ad9aa19a953cfb9f92d2e9 Mon Sep 17 00:00:00 2001 From: ataylorme Date: Fri, 13 Oct 2023 10:55:13 -0700 Subject: [PATCH 03/11] Add Okta `scope` to `Okta Authentication Provider` docs page Signed-off-by: ataylorme --- docs/auth/okta/provider.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index e4fc8bfb45..a0febe29f4 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -43,6 +43,8 @@ auth: audience: ${AUTH_OKTA_DOMAIN} authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional idp: ${AUTH_OKTA_IDP} # Optional + # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned + scope: ${AUTH_OKTA_SCOPE} # Optional ``` The values referenced are found on the Application page on your Okta site. @@ -55,6 +57,8 @@ The values referenced are found on the Application page on your Okta site. - `authServerId`: The authorization server ID for the Application - `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3` +`scope` is an optional value to change the `scope` value sent to Okta during OAuth. The default value is `openid profile email offline_access`. Chaning the `scope` will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, adding `groups` to the `scope` by setting the value to `openid profile email offline_access groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app. + ## Adding the provider to the Backstage frontend To add the provider to the frontend, add the `oktaAuthApi` reference and From d28efe24ffbf6723677c040ea685806a1e6db83c Mon Sep 17 00:00:00 2001 From: ataylorme Date: Fri, 13 Oct 2023 11:27:14 -0700 Subject: [PATCH 04/11] Type correction Signed-off-by: ataylorme --- docs/auth/okta/provider.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index a0febe29f4..95381dd02c 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -57,7 +57,7 @@ The values referenced are found on the Application page on your Okta site. - `authServerId`: The authorization server ID for the Application - `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3` -`scope` is an optional value to change the `scope` value sent to Okta during OAuth. The default value is `openid profile email offline_access`. Chaning the `scope` will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, adding `groups` to the `scope` by setting the value to `openid profile email offline_access groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app. +`scope` is an optional value to change the `scope` value sent to Okta during OAuth. The default value is `openid profile email offline_access`. Changing the `scope` will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, adding `groups` to the `scope` by setting the value to `openid profile email offline_access groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app. ## Adding the provider to the Backstage frontend From 1185e30cb4a981a429323a798f3a4db2ec03b051 Mon Sep 17 00:00:00 2001 From: ataylorme Date: Fri, 13 Oct 2023 15:11:11 -0700 Subject: [PATCH 05/11] Add test for okta auth custom scope Signed-off-by: ataylorme --- .../src/providers/okta/provider.test.ts | 44 ++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.test.ts b/plugins/auth-backend/src/providers/okta/provider.test.ts index bc27129300..f91f7fff89 100644 --- a/plugins/auth-backend/src/providers/okta/provider.test.ts +++ b/plugins/auth-backend/src/providers/okta/provider.test.ts @@ -17,13 +17,14 @@ import { OktaAuthProvider } from './provider'; import * as helpers from '../../lib/passport/PassportStrategyHelper'; import { OAuthResult } from '../../lib/oauth'; -import { AuthResolverContext } from '../types'; +import { AuthResolverContext, OAuthStartResponse } from '../types'; jest.mock('../../lib/passport/PassportStrategyHelper', () => { return { executeFrameHandlerStrategy: jest.fn(), executeRefreshTokenStrategy: jest.fn(), executeFetchUserProfileStrategy: jest.fn(), + executeRedirectStrategy: jest.fn(), }; }); @@ -34,6 +35,11 @@ const mockFrameHandler = jest.spyOn( () => Promise<{ result: OAuthResult; privateInfo: any }> >; +const mockRedirectStrategy = jest.spyOn( + helpers, + 'executeRedirectStrategy', +) as unknown as jest.MockedFunction<() => Promise>; + describe('createOktaProvider', () => { it('should auth', async () => { const provider = new OktaAuthProvider({ @@ -97,4 +103,40 @@ describe('createOktaProvider', () => { }, }); }); + + it('should pass a custom scope to start and refresh requests', async () => { + const mockScope = 'openid profile email offline_access groups'; + const reqScope = 'openid profile email offline_access'; + const provider = new OktaAuthProvider({ + resolverContext: {} as AuthResolverContext, + authHandler: async ({ fullProfile }) => ({ + profile: { + email: fullProfile.emails![0]!.value, + displayName: fullProfile.displayName, + }, + }), + audience: 'http://example.com', + clientId: 'mock', + clientSecret: 'mock', + callbackUrl: 'mock', + scope: mockScope, + }); + + mockRedirectStrategy.mockResolvedValueOnce({ + url: 'http://example.com/', + }); + + const req: any = { + state: { + nonce: 'nonce', + env: 'development', + }, + scope: reqScope, + }; + + await provider.start(req); + const mockCallScope = (mockRedirectStrategy.mock.calls[0] as any)?.[2] + ?.scope; + expect(mockCallScope).toBe(mockScope); + }); }); From 8466307819110b4a91cc503db6507d8aa16b708e Mon Sep 17 00:00:00 2001 From: ataylorme Date: Thu, 26 Oct 2023 05:29:03 -0700 Subject: [PATCH 06/11] Use additionalScopes for Okta auth instead of overriding scope entirely Signed-off-by: ataylorme --- .changeset/sharp-wombats-speak.md | 14 +++++----- docs/auth/okta/provider.md | 4 +-- plugins/auth-backend/config.d.ts | 1 + .../src/providers/okta/provider.test.ts | 3 +- .../src/providers/okta/provider.ts | 28 +++++++++++-------- 5 files changed, 29 insertions(+), 21 deletions(-) diff --git a/.changeset/sharp-wombats-speak.md b/.changeset/sharp-wombats-speak.md index ff6a349ed8..0771b45f16 100644 --- a/.changeset/sharp-wombats-speak.md +++ b/.changeset/sharp-wombats-speak.md @@ -2,7 +2,7 @@ '@backstage/plugin-auth-backend': minor --- -Allow user-defined scopes for Okta auth in config yaml +Allow additional user-defined scopes for Okta auth in config yaml Example `app-config.yaml` excerpt @@ -18,11 +18,11 @@ auth: authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional idp: ${AUTH_OKTA_IDP} # Optional # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned - scope: openid profile email offline_access groups # Optional + additionalScopes: groups # Optional ``` -- Accept a new scope option during okta creation with `createAuthProviderIntegration` -- Pass the user-defined `scope` as an option to `OktaAuthProvider` -- Add `scope` as an option for `OktaAuthProvider` -- Set `scope` in `OktaAuthProvider` to the `scope` passed as an `option` or a default of `'openid email profile offline_access'` if a user-defined option is not provided -- Update the `start` and `refresh` methods to use `scope` from `OktaAuthProvider` rather than `scope` from the request +- Accept a new additionalScope option during okta creation with `createAuthProviderIntegration` +- Passes the the user-defined `additionalScopes` as an option to `OktaAuthProvider` +- Add `additionalScopes` as an option for `OktaAuthProvider` +- Set `scope` in `OktaAuthProvider` to the combined value of current scopes combined with the user-defined `additionalScopes` passed as an `option` +- Update the `start` and `refresh` methods to use the new combiend `scope` from `OktaAuthProvider` rather than `scope` from the request diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index 95381dd02c..99ff664a67 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -44,7 +44,7 @@ auth: authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional idp: ${AUTH_OKTA_IDP} # Optional # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned - scope: ${AUTH_OKTA_SCOPE} # Optional + additionalScopes: ${AUTH_OKTA_ADDITIONAL_SCOPES} # Optional ``` The values referenced are found on the Application page on your Okta site. @@ -57,7 +57,7 @@ The values referenced are found on the Application page on your Okta site. - `authServerId`: The authorization server ID for the Application - `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3` -`scope` is an optional value to change the `scope` value sent to Okta during OAuth. The default value is `openid profile email offline_access`. Changing the `scope` will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, adding `groups` to the `scope` by setting the value to `openid profile email offline_access groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app. +`additionalScopes` is an optional value, a string of space separated scopes, that will be combined with the default `scope` value of `openid profile email offline_access` to adjust the `scope` sent to Okta during OAuth. This will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, setting the `additionalScopes` value to `groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app. ## Adding the provider to the Backstage frontend diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts index f8953e1588..36ed7eeaf8 100644 --- a/plugins/auth-backend/config.d.ts +++ b/plugins/auth-backend/config.d.ts @@ -131,6 +131,7 @@ export interface Config { authServerId?: string; idp?: string; callbackUrl?: string; + additionalScopes?: string; }; }; /** @visibility frontend */ diff --git a/plugins/auth-backend/src/providers/okta/provider.test.ts b/plugins/auth-backend/src/providers/okta/provider.test.ts index f91f7fff89..0534bfbb38 100644 --- a/plugins/auth-backend/src/providers/okta/provider.test.ts +++ b/plugins/auth-backend/src/providers/okta/provider.test.ts @@ -105,6 +105,7 @@ describe('createOktaProvider', () => { }); it('should pass a custom scope to start and refresh requests', async () => { + const additionalScopes = 'groups'; const mockScope = 'openid profile email offline_access groups'; const reqScope = 'openid profile email offline_access'; const provider = new OktaAuthProvider({ @@ -119,7 +120,7 @@ describe('createOktaProvider', () => { clientId: 'mock', clientSecret: 'mock', callbackUrl: 'mock', - scope: mockScope, + additionalScopes, }); mockRedirectStrategy.mockResolvedValueOnce({ diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 3ebc865726..6b27fbb612 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -60,7 +60,7 @@ export type OktaAuthProviderOptions = OAuthProviderOptions & { signInResolver?: SignInResolver; authHandler: AuthHandler; resolverContext: AuthResolverContext; - scope?: string; + additionalScopes?: string; }; export class OktaAuthProvider implements OAuthHandlers { @@ -68,7 +68,7 @@ export class OktaAuthProvider implements OAuthHandlers { private readonly signInResolver?: SignInResolver; private readonly authHandler: AuthHandler; private readonly resolverContext: AuthResolverContext; - private readonly scope: string; + private readonly additionalScopes: string; /** * Due to passport-okta-oauth forcing options.state = true, @@ -91,7 +91,7 @@ export class OktaAuthProvider implements OAuthHandlers { this.signInResolver = options.signInResolver; this.authHandler = options.authHandler; this.resolverContext = options.resolverContext; - this.scope = options.scope || 'openid email profile offline_access'; + this.additionalScopes = options.additionalScopes || ''; this.strategy = new OktaStrategy( { @@ -128,11 +128,19 @@ export class OktaAuthProvider implements OAuthHandlers { ); } + private combineScopeStrings(scopesA: string, scopesB: string) { + const scopesAArray = scopesA.split(' '); + const scopesBArray = scopesB.split(' '); + const combinedScopes = new Set([...scopesAArray, ...scopesBArray]); + return Array.from(combinedScopes).join(' '); + } + async start(req: OAuthStartRequest): Promise { + const scope = this.combineScopeStrings(req.scope, this.additionalScopes); return await executeRedirectStrategy(req, this.strategy, { accessType: 'offline', prompt: 'consent', - scope: this.scope, + scope: scope, state: encodeState(req.state), }); } @@ -150,12 +158,9 @@ export class OktaAuthProvider implements OAuthHandlers { } async refresh(req: OAuthRefreshRequest) { + const scope = this.combineScopeStrings(req.scope, this.additionalScopes); const { accessToken, refreshToken, params } = - await executeRefreshTokenStrategy( - this.strategy, - req.refreshToken, - this.scope, - ); + await executeRefreshTokenStrategy(this.strategy, req.refreshToken, scope); const fullProfile = await executeFetchUserProfileStrategy( this.strategy, @@ -233,7 +238,8 @@ export const okta = createAuthProviderIntegration({ const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`; - const scope = envConfig.getOptionalString('scope'); + const additionalScopes = + envConfig.getOptionalString('additionalScopes'); // This is a safe assumption as `passport-okta-oauth` uses the audience // as the base for building the authorization, token, and user info URLs. @@ -258,7 +264,7 @@ export const okta = createAuthProviderIntegration({ authHandler, signInResolver: options?.signIn?.resolver, resolverContext, - scope, + additionalScopes, }); return OAuthAdapter.fromConfig(globalConfig, provider, { From c276fa509ba6c1cb9d8eba1c93043ffff6f20a90 Mon Sep 17 00:00:00 2001 From: ataylorme Date: Thu, 26 Oct 2023 06:16:32 -0700 Subject: [PATCH 07/11] Spelling Signed-off-by: ataylorme --- .changeset/sharp-wombats-speak.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/sharp-wombats-speak.md b/.changeset/sharp-wombats-speak.md index 0771b45f16..dd46dee92a 100644 --- a/.changeset/sharp-wombats-speak.md +++ b/.changeset/sharp-wombats-speak.md @@ -21,8 +21,8 @@ auth: additionalScopes: groups # Optional ``` -- Accept a new additionalScope option during okta creation with `createAuthProviderIntegration` +- Accept a new ` additionalScopes`` option during okta creation with `createAuthProviderIntegration` - Passes the the user-defined `additionalScopes` as an option to `OktaAuthProvider` - Add `additionalScopes` as an option for `OktaAuthProvider` - Set `scope` in `OktaAuthProvider` to the combined value of current scopes combined with the user-defined `additionalScopes` passed as an `option` -- Update the `start` and `refresh` methods to use the new combiend `scope` from `OktaAuthProvider` rather than `scope` from the request +- Update the `start` and `refresh` methods to use the new combined `scope` from `OktaAuthProvider` rather than `scope` from the request From ac07663036dcbbadf59a8037759de9520bc0a46b Mon Sep 17 00:00:00 2001 From: ataylorme Date: Thu, 26 Oct 2023 08:02:46 -0700 Subject: [PATCH 08/11] Remove duplicate 'the' Signed-off-by: ataylorme --- .changeset/sharp-wombats-speak.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/sharp-wombats-speak.md b/.changeset/sharp-wombats-speak.md index dd46dee92a..21cb8dfaa4 100644 --- a/.changeset/sharp-wombats-speak.md +++ b/.changeset/sharp-wombats-speak.md @@ -22,7 +22,7 @@ auth: ``` - Accept a new ` additionalScopes`` option during okta creation with `createAuthProviderIntegration` -- Passes the the user-defined `additionalScopes` as an option to `OktaAuthProvider` +- Passes the user-defined `additionalScopes` as an option to `OktaAuthProvider` - Add `additionalScopes` as an option for `OktaAuthProvider` - Set `scope` in `OktaAuthProvider` to the combined value of current scopes combined with the user-defined `additionalScopes` passed as an `option` - Update the `start` and `refresh` methods to use the new combined `scope` from `OktaAuthProvider` rather than `scope` from the request From 5ae8214a4ddac682a587a1b623090f1b36f21bc8 Mon Sep 17 00:00:00 2001 From: ataylorme Date: Thu, 26 Oct 2023 08:05:04 -0700 Subject: [PATCH 09/11] Better naming of variable Signed-off-by: ataylorme --- plugins/auth-backend/src/providers/okta/provider.test.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.test.ts b/plugins/auth-backend/src/providers/okta/provider.test.ts index 0534bfbb38..588b00be02 100644 --- a/plugins/auth-backend/src/providers/okta/provider.test.ts +++ b/plugins/auth-backend/src/providers/okta/provider.test.ts @@ -106,8 +106,8 @@ describe('createOktaProvider', () => { it('should pass a custom scope to start and refresh requests', async () => { const additionalScopes = 'groups'; - const mockScope = 'openid profile email offline_access groups'; const reqScope = 'openid profile email offline_access'; + const combinedScope = `${reqScope} ${additionalScopes}`; const provider = new OktaAuthProvider({ resolverContext: {} as AuthResolverContext, authHandler: async ({ fullProfile }) => ({ @@ -138,6 +138,6 @@ describe('createOktaProvider', () => { await provider.start(req); const mockCallScope = (mockRedirectStrategy.mock.calls[0] as any)?.[2] ?.scope; - expect(mockCallScope).toBe(mockScope); + expect(mockCallScope).toBe(combinedScope); }); }); From 53c1681c3b79ee18058eab9c9221cac2702fcbdc Mon Sep 17 00:00:00 2001 From: Andrew Taylor Date: Mon, 13 Nov 2023 09:00:12 -0800 Subject: [PATCH 10/11] Update .changeset/sharp-wombats-speak.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: Andrew Taylor --- .changeset/sharp-wombats-speak.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/sharp-wombats-speak.md b/.changeset/sharp-wombats-speak.md index 21cb8dfaa4..1a5a8d4f19 100644 --- a/.changeset/sharp-wombats-speak.md +++ b/.changeset/sharp-wombats-speak.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-auth-backend': minor +'@backstage/plugin-auth-backend': patch --- Allow additional user-defined scopes for Okta auth in config yaml From b4a9b5a2febf657dd2f85ea655c67f6e73355d8f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 14 Nov 2023 11:26:48 +0100 Subject: [PATCH 11/11] Update .changeset/sharp-wombats-speak.md Signed-off-by: Patrik Oldsberg --- .changeset/sharp-wombats-speak.md | 25 +------------------------ 1 file changed, 1 insertion(+), 24 deletions(-) diff --git a/.changeset/sharp-wombats-speak.md b/.changeset/sharp-wombats-speak.md index 1a5a8d4f19..8a6dd39354 100644 --- a/.changeset/sharp-wombats-speak.md +++ b/.changeset/sharp-wombats-speak.md @@ -2,27 +2,4 @@ '@backstage/plugin-auth-backend': patch --- -Allow additional user-defined scopes for Okta auth in config yaml - -Example `app-config.yaml` excerpt - -```yml -auth: - environment: development - providers: - okta: - development: - clientId: ${AUTH_OKTA_CLIENT_ID} - clientSecret: ${AUTH_OKTA_CLIENT_SECRET} - audience: ${AUTH_OKTA_DOMAIN} - authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional - idp: ${AUTH_OKTA_IDP} # Optional - # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned - additionalScopes: groups # Optional -``` - -- Accept a new ` additionalScopes`` option during okta creation with `createAuthProviderIntegration` -- Passes the user-defined `additionalScopes` as an option to `OktaAuthProvider` -- Add `additionalScopes` as an option for `OktaAuthProvider` -- Set `scope` in `OktaAuthProvider` to the combined value of current scopes combined with the user-defined `additionalScopes` passed as an `option` -- Update the `start` and `refresh` methods to use the new combined `scope` from `OktaAuthProvider` rather than `scope` from the request +Added an optional `additionalScopes` configuration parameter to `okta` providers, that lets you add additional scopes on top of the default ones.