From 8f461e6043288a3f5dc459de62bf1919c81e142c Mon Sep 17 00:00:00 2001
From: Johan Haals <johan.haals@gmail.com>
Date: Tue, 7 Dec 2021 10:59:52 +0100
Subject: [PATCH] auth-backend(fix): Add basicAuth option to OAuth provider

Signed-off-by: Johan Haals <johan.haals@gmail.com>
---
 .changeset/clean-apples-breathe.md              |  6 ++++++
 .../src/providers/oauth2/provider.ts            | 17 +++++++++++------
 2 files changed, 17 insertions(+), 6 deletions(-)
 create mode 100644 .changeset/clean-apples-breathe.md

diff --git a/.changeset/clean-apples-breathe.md b/.changeset/clean-apples-breathe.md
new file mode 100644
index 0000000000..f946b9496a
--- /dev/null
+++ b/.changeset/clean-apples-breathe.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixes potential bug introduced in `0.4.10` which causes `OAuth2AuthProvider` to authenticate using credentials in both POST payload and headers.
+This might break some stricter OAuth2 implementations so there is now a `basicAuth` config option that can manually be set to `true` to enable this behavior.
diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts
index 1160ad19c9..b7978bcf79 100644
--- a/plugins/auth-backend/src/providers/oauth2/provider.ts
+++ b/plugins/auth-backend/src/providers/oauth2/provider.ts
@@ -59,6 +59,7 @@ export type OAuth2AuthProviderOptions = OAuthProviderOptions & {
   tokenUrl: string;
   scope?: string;
   logger: Logger;
+  basicAuth?: boolean;
 };
 
 export class OAuth2AuthProvider implements OAuthHandlers {
@@ -85,12 +86,14 @@ export class OAuth2AuthProvider implements OAuthHandlers {
         tokenURL: options.tokenUrl,
         passReqToCallback: false as true,
         scope: options.scope,
-        customHeaders: {
-          Authorization: `Basic ${this.encodeClientCredentials(
-            options.clientId,
-            options.clientSecret,
-          )}`,
-        },
+        customHeaders: options.basicAuth
+          ? {
+              Authorization: `Basic ${this.encodeClientCredentials(
+                options.clientId,
+                options.clientSecret,
+              )}`,
+            }
+          : undefined,
       },
       (
         accessToken: any,
@@ -244,6 +247,7 @@ export const createOAuth2Provider = (
       const authorizationUrl = envConfig.getString('authorizationUrl');
       const tokenUrl = envConfig.getString('tokenUrl');
       const scope = envConfig.getOptionalString('scope');
+      const basicAuth = envConfig.getOptionalBoolean('basicAuth');
       const disableRefresh =
         envConfig.getOptionalBoolean('disableRefresh') ?? false;
 
@@ -280,6 +284,7 @@ export const createOAuth2Provider = (
         tokenUrl,
         scope,
         logger,
+        basicAuth,
       });
 
       return OAuthAdapter.fromConfig(globalConfig, provider, {