Identity and profile work, wip

plugins/auth-backend/src/lib/OAuthProvider.test.ts

@@ -116,7 +116,10 @@ describe('OAuthProvider Utils', () => {
           profile: {
             email: 'foo@bar.com',
           },
-          userIdToken: 'a.b.c',
+          backstageIdentity: {
+            id: 'a',
+            idToken: 'a.b.c',
+          },
         },
       };
       const jsonData = JSON.stringify(data);
@@ -346,7 +349,10 @@ describe('OAuthProvider', () => {
     expect(mockResponse.send).toHaveBeenCalledTimes(1);
     expect(mockResponse.send).toHaveBeenCalledWith({
       ...mockResponseData,
-      userIdToken: 'my-id-token',
+      backstageIdentity: {
+        id: mockResponseData.profile.email,
+        idToken: 'my-id-token',
+      },
     });
   });
 

plugins/auth-backend/src/lib/OAuthProvider.ts

@@ -147,12 +147,13 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
         this.setRefreshTokenCookie(res, refreshToken);
       }
 
-      const userIdToken = await this.options.tokenIssuer.issueToken({
-        claims: { sub: response.profile.email },
+      const id = response.profile.email;
+      const idToken = await this.options.tokenIssuer.issueToken({
+        claims: { sub: id },
       });
       const fullResponse: AuthResponse<unknown> = {
         ...response,
-        userIdToken,
+        backstageIdentity: { id, idToken },
       };
 
       // post message back to popup if successful
@@ -212,12 +213,13 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
       // get new access_token
       const response = await this.providerHandlers.refresh(refreshToken, scope);
 
-      const userIdToken = await this.options.tokenIssuer.issueToken({
-        claims: { sub: response.profile.email },
+      const id = response.profile.email;
+      const idToken = await this.options.tokenIssuer.issueToken({
+        claims: { sub: id },
       });
       const fullResponse: AuthResponse<unknown> = {
         ...response,
-        userIdToken,
+        backstageIdentity: { id, idToken },
       };
 
       res.send(fullResponse);

plugins/auth-backend/src/providers/saml/provider.ts

@@ -84,8 +84,9 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
         response: { userId, profile },
       } = await executeFrameHandlerStrategy<SamlInfo>(req, this.strategy);
 
-      const userIdToken = await this.tokenIssuer.issueToken({
-        claims: { sub: userId },
+      const id = userId;
+      const idToken = await this.tokenIssuer.issueToken({
+        claims: { sub: id },
       });
 
       return postMessageResponse(res, 'http://localhost:3000', {
@@ -93,7 +94,7 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
         response: {
           providerInfo: {},
           profile,
-          userIdToken,
+          backstageIdentity: { id, idToken },
         },
       });
     } catch (error) {

plugins/auth-backend/src/providers/types.ts

@@ -192,14 +192,26 @@ export type AuthProviderFactory = (
 export type AuthResponse<ProviderInfo> = {
   providerInfo: ProviderInfo;
   profile: ProfileInfo;
-  userIdToken: string;
+  backstageIdentity: BackstageIdentity;
 };
 
 export type OAuthResponse = Omit<
   AuthResponse<OAuthProviderInfo>,
-  'userIdToken'
+  'backstageIdentity'
 >;
 
+export type BackstageIdentity = {
+  /**
+   * The backstage user ID.
+   */
+  id: string;
+
+  /**
+   * An ID token that can be used to authenticate the user within Backstage.
+   */
+  idToken: string;
+};
+
 export type OAuthProviderInfo = {
   /**
    * An access token issued for the signed in user.

plugins/auth-backend/src/service/router.ts

@@ -67,12 +67,6 @@ export async function createRouter(
             clientId: process.env.AUTH_GOOGLE_CLIENT_ID!,
             clientSecret: process.env.AUTH_GOOGLE_CLIENT_SECRET!,
           },
-          production: {
-            appOrigin: 'http://localhost:3000',
-            secure: false,
-            clientId: '',
-            clientSecret: '',
-          },
         },
         github: {
           development: {