From c27ae5004fc2edb7fa66272e597656a612a3fbcb Mon Sep 17 00:00:00 2001 From: Karthik Prabhu K Date: Thu, 29 Jun 2023 22:00:57 +0530 Subject: [PATCH 1/6] Support for configuring the desired Client Authentication Method for the token endpoint for the OIDC Provider Signed-off-by: Karthik Prabhu K --- .changeset/tender-clouds-promise.md | 5 +++++ app-config.yaml | 1 + docs/auth/oidc.md | 2 +- plugins/auth-backend/src/providers/oidc/provider.test.ts | 1 + plugins/auth-backend/src/providers/oidc/provider.ts | 8 ++++++++ 5 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 .changeset/tender-clouds-promise.md diff --git a/.changeset/tender-clouds-promise.md b/.changeset/tender-clouds-promise.md new file mode 100644 index 0000000000..171ffb0174 --- /dev/null +++ b/.changeset/tender-clouds-promise.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': minor +--- + +Support for Token Endpoint Auth Method for OIDC Provider diff --git a/app-config.yaml b/app-config.yaml index a4a332efdc..2b562ee689 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -354,6 +354,7 @@ auth: clientSecret: ${AUTH_OIDC_CLIENT_SECRET} authorizationUrl: ${AUTH_OIDC_AUTH_URL} tokenUrl: ${AUTH_OIDC_TOKEN_URL} + tokenEndpointAuthMethod: ${AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD} # default='client_secret_basic' tokenSignedResponseAlg: ${AUTH_OIDC_TOKEN_SIGNED_RESPONSE_ALG} # default='RS256' scope: ${AUTH_OIDC_SCOPE} # default='openid profile email' prompt: ${AUTH_OIDC_PROMPT} # default=none (allowed values: auto, none, consent, login) diff --git a/docs/auth/oidc.md b/docs/auth/oidc.md index 9c681b7360..39c18ce0aa 100644 --- a/docs/auth/oidc.md +++ b/docs/auth/oidc.md @@ -237,7 +237,7 @@ check the App Registration you created: - `metadataUrl`: In Overview > Endpoints tab, grab OpenID Connect metadata document URL. - `authorizationUrl` and `tokenUrl`: Open the `metadataUrl` in a browser, that json will hold these 2 urls somewhere in there. -- `tokenSignedResponseAlg`: Don't define it, use the default unless you know what it does. +- `tokenEndpointAuthMethod` and `tokenSignedResponseAlg`: Don't define it, use the default unless you know what it does. - `scope`: Only used if we didn't specify `defaultScopes` in the provider's factory, basically the same thing. - `prompt`: Recommended to use `auto` so the browser will request login to the IDP if the diff --git a/plugins/auth-backend/src/providers/oidc/provider.test.ts b/plugins/auth-backend/src/providers/oidc/provider.test.ts index 2285b60ed0..7161ef1d6b 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.test.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.test.ts @@ -53,6 +53,7 @@ const clientMetadata: Options = { clientId: 'testclientid', clientSecret: 'testclientsecret', metadataUrl: 'https://oidc.test/.well-known/openid-configuration', + tokenEndpointAuthMethod: 'none', tokenSignedResponseAlg: 'none', }; diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index ed59611f21..73c5feef4b 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -17,6 +17,7 @@ import express from 'express'; import { Client, + ClientAuthMethod, Issuer, Strategy as OidcStrategy, TokenSet, @@ -72,6 +73,7 @@ export type Options = OAuthProviderOptions & { metadataUrl: string; scope?: string; prompt?: string; + tokenEndpointAuthMethod?: ClientAuthMethod; tokenSignedResponseAlg?: string; signInResolver?: SignInResolver; authHandler: AuthHandler; @@ -144,6 +146,8 @@ export class OidcAuthProvider implements OAuthHandlers { client_secret: options.clientSecret, redirect_uris: [options.callbackUrl], response_types: ['code'], + token_endpoint_auth_method: + options.tokenEndpointAuthMethod || 'client_secret_basic', id_token_signed_response_alg: options.tokenSignedResponseAlg || 'RS256', scope: options.scope || '', }); @@ -232,6 +236,9 @@ export const oidc = createAuthProviderIntegration({ customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`; const metadataUrl = envConfig.getString('metadataUrl'); + const tokenEndpointAuthMethod = envConfig.getOptional( + 'tokenEndpointAuthMethod', + ); const tokenSignedResponseAlg = envConfig.getOptionalString( 'tokenSignedResponseAlg', ); @@ -252,6 +259,7 @@ export const oidc = createAuthProviderIntegration({ clientId, clientSecret, callbackUrl, + tokenEndpointAuthMethod, tokenSignedResponseAlg, metadataUrl, scope, From 9fdae5ef33032fd7da724af8f772545121686619 Mon Sep 17 00:00:00 2001 From: Karthik Prabhu K Date: Mon, 3 Jul 2023 23:12:54 +0530 Subject: [PATCH 2/6] Updated documentation Signed-off-by: Karthik Prabhu K --- docs/auth/oidc.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/auth/oidc.md b/docs/auth/oidc.md index 39c18ce0aa..1882cb73f1 100644 --- a/docs/auth/oidc.md +++ b/docs/auth/oidc.md @@ -237,7 +237,8 @@ check the App Registration you created: - `metadataUrl`: In Overview > Endpoints tab, grab OpenID Connect metadata document URL. - `authorizationUrl` and `tokenUrl`: Open the `metadataUrl` in a browser, that json will hold these 2 urls somewhere in there. -- `tokenEndpointAuthMethod` and `tokenSignedResponseAlg`: Don't define it, use the default unless you know what it does. +- `tokenEndpointAuthMethod`: Don't define it, use the default unless you know what it does. +- `tokenSignedResponseAlg`: Don't define it, use the default unless you know what it does. - `scope`: Only used if we didn't specify `defaultScopes` in the provider's factory, basically the same thing. - `prompt`: Recommended to use `auto` so the browser will request login to the IDP if the From d0c25afed231c34e12e3d97abd075e0c45ba8dc0 Mon Sep 17 00:00:00 2001 From: Ben Lambert Date: Tue, 4 Jul 2023 10:21:00 +0200 Subject: [PATCH 3/6] Update tender-clouds-promise.md Signed-off-by: Ben Lambert --- .changeset/tender-clouds-promise.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/tender-clouds-promise.md b/.changeset/tender-clouds-promise.md index 171ffb0174..3bc83b1482 100644 --- a/.changeset/tender-clouds-promise.md +++ b/.changeset/tender-clouds-promise.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-auth-backend': minor +'@backstage/plugin-auth-backend': patch --- Support for Token Endpoint Auth Method for OIDC Provider From ec04fc53d5d9d3f1f11a54998852875bb0813509 Mon Sep 17 00:00:00 2001 From: Ben Lambert Date: Tue, 4 Jul 2023 10:22:36 +0200 Subject: [PATCH 4/6] Update provider.ts Signed-off-by: Ben Lambert --- plugins/auth-backend/src/providers/oidc/provider.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index 73c5feef4b..49ecc6de8c 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -236,7 +236,7 @@ export const oidc = createAuthProviderIntegration({ customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`; const metadataUrl = envConfig.getString('metadataUrl'); - const tokenEndpointAuthMethod = envConfig.getOptional( + const tokenEndpointAuthMethod = envConfig.getOptionalString( 'tokenEndpointAuthMethod', ); const tokenSignedResponseAlg = envConfig.getOptionalString( From be4d6aefbd314bb0cbb6b731574b2032a3b935c8 Mon Sep 17 00:00:00 2001 From: Ben Lambert Date: Tue, 4 Jul 2023 10:25:15 +0200 Subject: [PATCH 5/6] Update provider.ts Signed-off-by: Ben Lambert --- plugins/auth-backend/src/providers/oidc/provider.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index 49ecc6de8c..ab4e1f7ee0 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -1,4 +1,4 @@ -/* +z/* * Copyright 2020 The Backstage Authors * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -236,9 +236,9 @@ export const oidc = createAuthProviderIntegration({ customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`; const metadataUrl = envConfig.getString('metadataUrl'); - const tokenEndpointAuthMethod = envConfig.getOptionalString( + const tokenEndpointAuthMethod = envConfig.getOptionalString( 'tokenEndpointAuthMethod', - ); + ) as ClientAuthMethod; const tokenSignedResponseAlg = envConfig.getOptionalString( 'tokenSignedResponseAlg', ); From bd82e8c0183a0ffa4edaeae295354ff031b2049e Mon Sep 17 00:00:00 2001 From: blam Date: Tue, 4 Jul 2023 10:45:28 +0200 Subject: [PATCH 6/6] chore: woops fix the additional char Signed-off-by: blam --- plugins/auth-backend/src/providers/oidc/provider.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index ab4e1f7ee0..7638027b01 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -1,4 +1,4 @@ -z/* +/* * Copyright 2020 The Backstage Authors * * Licensed under the Apache License, Version 2.0 (the "License");