Merge pull request #6460 from livetocode/master

fix OIDC Auth provider

.changeset/little-colts-hang.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Configuration updates for the `OpenID Connect` auth provider to allow `prompt` configuration and some sensible defaults.

app-config.yaml

@@ -314,13 +314,20 @@ auth:
         #
         # scope: saml-login-selector openid profile email
     oidc:
+      # Note that you must define a session secret (see above) since the oidc provider requires session support.
+      # Note that by default, this provider will use the 'none' prompt which assumes that your are already logged on in the IDP.
+      # You should set prompt to:
+      # - auto: will let the IDP decide if you need to log on or if you can skip login when you have an active SSO session
+      # - login: will force the IDP to always present a login form to the user
       development:
         metadataUrl: ${AUTH_OIDC_METADATA_URL}
         clientId: ${AUTH_OIDC_CLIENT_ID}
         clientSecret: ${AUTH_OIDC_CLIENT_SECRET}
         authorizationUrl: ${AUTH_OIDC_AUTH_URL}
         tokenUrl: ${AUTH_OIDC_TOKEN_URL}
-        tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG}
+        tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256'
+        scope: ${AUTH_OIDC_SCOPE} # default='openid profile email'
+        prompt: ${AUTH_OIDC_PROMPT} # default=none (allowed values: auto, none, consent, login)
     auth0:
       development:
         clientId: ${AUTH_AUTH0_CLIENT_ID}

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -56,26 +56,33 @@ type AuthResult = {
 export type Options = OAuthProviderOptions & {
   metadataUrl: string;
   scope?: string;
+  prompt?: string;
   tokenSignedResponseAlg?: string;
 };
 
 export class OidcAuthProvider implements OAuthHandlers {
   private readonly implementation: Promise<OidcImpl>;
   private readonly scope?: string;
+  private readonly prompt?: string;
 
   constructor(options: Options) {
     this.implementation = this.setupStrategy(options);
     this.scope = options.scope;
+    this.prompt = options.prompt;
   }
 
   async start(req: OAuthStartRequest): Promise<RedirectInfo> {
     const { strategy } = await this.implementation;
-    return await executeRedirectStrategy(req, strategy, {
+    const options: Record<string, string> = {
       accessType: 'offline',
-      prompt: 'none',
-      scope: req.scope || this.scope || '',
+      scope: req.scope || this.scope || 'openid profile email',
       state: encodeState(req.state),
-    });
+    };
+    const prompt = this.prompt || 'none';
+    if (prompt !== 'auto') {
+      options.prompt = prompt;
+    }
+    return await executeRedirectStrategy(req, strategy, options);
   }
 
   async handler(
@@ -190,10 +197,11 @@ export const createOidcProvider = (
       const clientSecret = envConfig.getString('clientSecret');
       const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       const metadataUrl = envConfig.getString('metadataUrl');
-      const tokenSignedResponseAlg = envConfig.getString(
+      const tokenSignedResponseAlg = envConfig.getOptionalString(
         'tokenSignedResponseAlg',
       );
       const scope = envConfig.getOptionalString('scope');
+      const prompt = envConfig.getOptionalString('prompt');
 
       const provider = new OidcAuthProvider({
         clientId,
@@ -202,6 +210,7 @@ export const createOidcProvider = (
         tokenSignedResponseAlg,
         metadataUrl,
         scope,
+        prompt,
       });
 
       return OAuthAdapter.fromConfig(globalConfig, provider, {