From da70a0cc1bf1b4e808f9d5c008bf07be26724949 Mon Sep 17 00:00:00 2001 From: Morgan Martinet Date: Tue, 13 Jul 2021 18:42:07 -0400 Subject: [PATCH 1/4] fix(oidc): do not use prompt=none which prevents the login dialog Signed-off-by: Morgan Martinet --- app-config.yaml | 5 ++++- plugins/auth-backend/src/providers/oidc/provider.ts | 11 ++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/app-config.yaml b/app-config.yaml index b50de963ed..d323c15776 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -312,13 +312,16 @@ auth: # # scope: saml-login-selector openid profile email oidc: + # Note that you must define a session secret (above) since the oidc provider requires session support development: metadataUrl: ${AUTH_OIDC_METADATA_URL} clientId: ${AUTH_OIDC_CLIENT_ID} clientSecret: ${AUTH_OIDC_CLIENT_SECRET} authorizationUrl: ${AUTH_OIDC_AUTH_URL} tokenUrl: ${AUTH_OIDC_TOKEN_URL} - tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} + tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256' + scope: ${AUTH_OIDC_SCOPE} # default='openid profile email' + prompt: ${AUTH_OIDC_PROMPT} # default='' (allowed values: '', 'none', 'consent', 'login') auth0: development: clientId: ${AUTH_AUTH0_CLIENT_ID} diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index 7a13d04a93..c98a8f62b3 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -56,24 +56,27 @@ type AuthResult = { export type Options = OAuthProviderOptions & { metadataUrl: string; scope?: string; + prompt?: string; tokenSignedResponseAlg?: string; }; export class OidcAuthProvider implements OAuthHandlers { private readonly implementation: Promise; private readonly scope?: string; + private readonly prompt?: string; constructor(options: Options) { this.implementation = this.setupStrategy(options); this.scope = options.scope; + this.prompt = options.prompt; } async start(req: OAuthStartRequest): Promise { const { strategy } = await this.implementation; return await executeRedirectStrategy(req, strategy, { accessType: 'offline', - prompt: 'none', - scope: req.scope || this.scope || '', + prompt: this.prompt || '', + scope: req.scope || this.scope || 'openid profile email', state: encodeState(req.state), }); } @@ -190,10 +193,11 @@ export const createOidcProvider = ( const clientSecret = envConfig.getString('clientSecret'); const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; const metadataUrl = envConfig.getString('metadataUrl'); - const tokenSignedResponseAlg = envConfig.getString( + const tokenSignedResponseAlg = envConfig.getOptionalString( 'tokenSignedResponseAlg', ); const scope = envConfig.getOptionalString('scope'); + const prompt = envConfig.getOptionalString('prompt'); const provider = new OidcAuthProvider({ clientId, @@ -202,6 +206,7 @@ export const createOidcProvider = ( tokenSignedResponseAlg, metadataUrl, scope, + prompt, }); return OAuthAdapter.fromConfig(globalConfig, provider, { From 40b3c60e2b2a03a97b24ca8606c4f6a983d6a161 Mon Sep 17 00:00:00 2001 From: Morgan Martinet Date: Tue, 13 Jul 2021 19:05:14 -0400 Subject: [PATCH 2/4] add changeset for the PR Signed-off-by: Morgan Martinet --- .changeset/little-colts-hang.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/little-colts-hang.md diff --git a/.changeset/little-colts-hang.md b/.changeset/little-colts-hang.md new file mode 100644 index 0000000000..e00e53240f --- /dev/null +++ b/.changeset/little-colts-hang.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Fix oidc auth provider From ac3ea828b1ae4dd2d92a4d5e78a7253f02c79c5e Mon Sep 17 00:00:00 2001 From: livetocode Date: Wed, 14 Jul 2021 01:10:46 -0400 Subject: [PATCH 3/4] Update .changeset/little-colts-hang.md and reformat app-config.yaml Co-authored-by: Tim Hansen Signed-off-by: Morgan Martinet --- .changeset/little-colts-hang.md | 2 +- app-config.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.changeset/little-colts-hang.md b/.changeset/little-colts-hang.md index e00e53240f..ecc55e9d33 100644 --- a/.changeset/little-colts-hang.md +++ b/.changeset/little-colts-hang.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend': patch --- -Fix oidc auth provider +Configuration updates for the `OpenID Connect` auth provider to allow `prompt` configuration and some sensible defaults. diff --git a/app-config.yaml b/app-config.yaml index d323c15776..20e7470091 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -320,8 +320,8 @@ auth: authorizationUrl: ${AUTH_OIDC_AUTH_URL} tokenUrl: ${AUTH_OIDC_TOKEN_URL} tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256' - scope: ${AUTH_OIDC_SCOPE} # default='openid profile email' - prompt: ${AUTH_OIDC_PROMPT} # default='' (allowed values: '', 'none', 'consent', 'login') + scope: ${AUTH_OIDC_SCOPE} # default='openid profile email' + prompt: ${AUTH_OIDC_PROMPT} # default='' (allowed values: '', 'none', 'consent', 'login') auth0: development: clientId: ${AUTH_AUTH0_CLIENT_ID} From 4036d634a072672b5054e2cfc665c9e314f64c2c Mon Sep 17 00:00:00 2001 From: Morgan Martinet Date: Wed, 14 Jul 2021 17:01:38 -0400 Subject: [PATCH 4/4] use original prompt default value to avoid a breaking change Signed-off-by: Morgan Martinet --- app-config.yaml | 8 ++++++-- plugins/auth-backend/src/providers/oidc/provider.ts | 10 +++++++--- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/app-config.yaml b/app-config.yaml index 20e7470091..57dff422db 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -312,7 +312,11 @@ auth: # # scope: saml-login-selector openid profile email oidc: - # Note that you must define a session secret (above) since the oidc provider requires session support + # Note that you must define a session secret (see above) since the oidc provider requires session support. + # Note that by default, this provider will use the 'none' prompt which assumes that your are already logged on in the IDP. + # You should set prompt to: + # - auto: will let the IDP decide if you need to log on or if you can skip login when you have an active SSO session + # - login: will force the IDP to always present a login form to the user development: metadataUrl: ${AUTH_OIDC_METADATA_URL} clientId: ${AUTH_OIDC_CLIENT_ID} @@ -321,7 +325,7 @@ auth: tokenUrl: ${AUTH_OIDC_TOKEN_URL} tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256' scope: ${AUTH_OIDC_SCOPE} # default='openid profile email' - prompt: ${AUTH_OIDC_PROMPT} # default='' (allowed values: '', 'none', 'consent', 'login') + prompt: ${AUTH_OIDC_PROMPT} # default=none (allowed values: auto, none, consent, login) auth0: development: clientId: ${AUTH_AUTH0_CLIENT_ID} diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index c98a8f62b3..306adc70f5 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -73,12 +73,16 @@ export class OidcAuthProvider implements OAuthHandlers { async start(req: OAuthStartRequest): Promise { const { strategy } = await this.implementation; - return await executeRedirectStrategy(req, strategy, { + const options: Record = { accessType: 'offline', - prompt: this.prompt || '', scope: req.scope || this.scope || 'openid profile email', state: encodeState(req.state), - }); + }; + const prompt = this.prompt || 'none'; + if (prompt !== 'auto') { + options.prompt = prompt; + } + return await executeRedirectStrategy(req, strategy, options); } async handler(