From 6dcc5f1d3e6bcae63dc0a6870af8307527c42a98 Mon Sep 17 00:00:00 2001 From: Manuel Scurti Date: Sat, 21 May 2022 12:49:39 +0200 Subject: [PATCH 1/4] fixed migration script for signing_keys Signed-off-by: Manuel Scurti --- .../auth-backend/migrations/20200619125845_init.js | 12 +++++++++++- plugins/auth-backend/src/identity/TokenFactory.ts | 3 +++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/plugins/auth-backend/migrations/20200619125845_init.js b/plugins/auth-backend/migrations/20200619125845_init.js index d5fc08ce48..6697d168c0 100644 --- a/plugins/auth-backend/migrations/20200619125845_init.js +++ b/plugins/auth-backend/migrations/20200619125845_init.js @@ -20,6 +20,13 @@ * @param {import('knex').Knex} knex */ exports.up = async function up(knex) { + /** + * key field length. must be enough for the chosen JWT signing algorithm. + * the default value is set to be enough for all supported algorithms of the + * `jose` library. + */ + const SIGNING_KEY_MAX_LENGTH = 512; + return knex.schema.createTable('signing_keys', table => { table.comment( 'Signing keys that are currently in use or have recently been used to issue tokens', @@ -34,7 +41,10 @@ exports.up = async function up(knex) { .notNullable() .defaultTo(knex.fn.now()) .comment('The creation time of the key'); - table.string('key').notNullable().comment('The serialized signing key'); + table + .string('key', SIGNING_KEY_MAX_LENGTH) + .notNullable() + .comment('The serialized signing key'); }); }; diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts index fe9d2a1b4f..fdc7210650 100644 --- a/plugins/auth-backend/src/identity/TokenFactory.ts +++ b/plugins/auth-backend/src/identity/TokenFactory.ts @@ -34,6 +34,9 @@ type Options = { keyDurationSeconds: number; /** JWS "alg" (Algorithm) Header Parameter value. Defaults to ES256. * Must match one of the algorithms defined for IdentityClient. + * When setting a different algorithm, check if the `key` field + * of the `signing_keys` table can fit the length of the generated keys. + * If not, modify the migration file in the migrations folder. * More info on supported algorithms: https://github.com/panva/jose */ algorithm?: string; }; From 5e055079f09dab315d37a58dac799673af8bccb9 Mon Sep 17 00:00:00 2001 From: Manuel Scurti Date: Sat, 21 May 2022 13:00:40 +0200 Subject: [PATCH 2/4] added changeset Signed-off-by: Manuel Scurti --- .changeset/fifty-planes-dream.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/fifty-planes-dream.md diff --git a/.changeset/fifty-planes-dream.md b/.changeset/fifty-planes-dream.md new file mode 100644 index 0000000000..655cd42dc1 --- /dev/null +++ b/.changeset/fifty-planes-dream.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Increased key field size for signing_keys table to account for larger signature keys From 416014b7b810f5d58f3bf7a111efec4a2b9662ef Mon Sep 17 00:00:00 2001 From: Manuel Scurti Date: Sun, 22 May 2022 19:30:40 +0200 Subject: [PATCH 3/4] added migration file Signed-off-by: Manuel Scurti --- .../migrations/20200619125845_init.js | 12 +---- .../20220522100910_key_field_size.js | 49 +++++++++++++++++++ .../auth-backend/src/identity/TokenFactory.ts | 2 +- 3 files changed, 51 insertions(+), 12 deletions(-) create mode 100644 plugins/auth-backend/migrations/20220522100910_key_field_size.js diff --git a/plugins/auth-backend/migrations/20200619125845_init.js b/plugins/auth-backend/migrations/20200619125845_init.js index 6697d168c0..d5fc08ce48 100644 --- a/plugins/auth-backend/migrations/20200619125845_init.js +++ b/plugins/auth-backend/migrations/20200619125845_init.js @@ -20,13 +20,6 @@ * @param {import('knex').Knex} knex */ exports.up = async function up(knex) { - /** - * key field length. must be enough for the chosen JWT signing algorithm. - * the default value is set to be enough for all supported algorithms of the - * `jose` library. - */ - const SIGNING_KEY_MAX_LENGTH = 512; - return knex.schema.createTable('signing_keys', table => { table.comment( 'Signing keys that are currently in use or have recently been used to issue tokens', @@ -41,10 +34,7 @@ exports.up = async function up(knex) { .notNullable() .defaultTo(knex.fn.now()) .comment('The creation time of the key'); - table - .string('key', SIGNING_KEY_MAX_LENGTH) - .notNullable() - .comment('The serialized signing key'); + table.string('key').notNullable().comment('The serialized signing key'); }); }; diff --git a/plugins/auth-backend/migrations/20220522100910_key_field_size.js b/plugins/auth-backend/migrations/20220522100910_key_field_size.js new file mode 100644 index 0000000000..c6637525f3 --- /dev/null +++ b/plugins/auth-backend/migrations/20220522100910_key_field_size.js @@ -0,0 +1,49 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// @ts-check + +/** + * @param {import('knex').Knex} knex + */ +exports.up = async function up(knex) { + // Sqlite does not support alter column. + if (!knex.client.config.client.includes('sqlite3')) { + await knex.schema.alterTable('signing_keys', table => { + table + .text('key') + .notNullable() + .comment('The serialized signing key') + .alter({ alterType: true }); + }); + } +}; + +/** + * @param {import('knex').Knex} knex + */ +exports.down = async function down(knex) { + // Sqlite does not support alter column. + if (!knex.client.config.client.includes('sqlite3')) { + await knex.schema.alterTable('signing_keys', table => { + table + .string('key') + .notNullable() + .comment('The serialized signing key') + .alter({ alterType: true }); + }); + } +}; diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts index fdc7210650..44cfebfb71 100644 --- a/plugins/auth-backend/src/identity/TokenFactory.ts +++ b/plugins/auth-backend/src/identity/TokenFactory.ts @@ -36,7 +36,7 @@ type Options = { * Must match one of the algorithms defined for IdentityClient. * When setting a different algorithm, check if the `key` field * of the `signing_keys` table can fit the length of the generated keys. - * If not, modify the migration file in the migrations folder. + * If not, add a knex migration file in the migrations folder. * More info on supported algorithms: https://github.com/panva/jose */ algorithm?: string; }; From 35780e76e486d5b65b56dea7f58b8718df802125 Mon Sep 17 00:00:00 2001 From: Manuel Scurti Date: Thu, 26 May 2022 17:15:30 +0200 Subject: [PATCH 4/4] fixed copyright year Signed-off-by: Manuel Scurti --- .../auth-backend/migrations/20220522100910_key_field_size.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/auth-backend/migrations/20220522100910_key_field_size.js b/plugins/auth-backend/migrations/20220522100910_key_field_size.js index c6637525f3..c27d038223 100644 --- a/plugins/auth-backend/migrations/20220522100910_key_field_size.js +++ b/plugins/auth-backend/migrations/20220522100910_key_field_size.js @@ -1,5 +1,5 @@ /* - * Copyright 2020 The Backstage Authors + * Copyright 2022 The Backstage Authors * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License.