From 21e071fa6c26ebec4dcca013d55351d56e024d59 Mon Sep 17 00:00:00 2001 From: Forrest Waters Date: Wed, 28 Oct 2020 18:23:13 -0500 Subject: [PATCH 1/6] working onelogin auth implementation --- app-config.yaml | 8 + packages/app/src/identityProviders.ts | 7 + .../core-api/src/apis/definitions/auth.ts | 11 ++ .../src/apis/implementations/auth/index.ts | 1 + .../auth/onelogin/OktaAuth.test.ts | 61 +++++++ .../auth/onelogin/OneLoginAuth.ts | 82 +++++++++ .../implementations/auth/onelogin/index.ts | 17 ++ packages/core/src/api-wrappers/defaultApis.ts | 11 ++ .../lib/passport/PassportStrategyHelper.ts | 1 - .../auth-backend/src/providers/factories.ts | 2 + .../src/providers/onelogin/index.ts | 1 + .../src/providers/onelogin/provider.ts | 160 ++++++++++++++++++ .../src/providers/onelogin/types.d.ts | 20 +++ 13 files changed, 381 insertions(+), 1 deletion(-) create mode 100644 packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts create mode 100644 packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts create mode 100644 packages/core-api/src/apis/implementations/auth/onelogin/index.ts create mode 100644 plugins/auth-backend/src/providers/onelogin/index.ts create mode 100644 plugins/auth-backend/src/providers/onelogin/provider.ts create mode 100644 plugins/auth-backend/src/providers/onelogin/types.d.ts diff --git a/app-config.yaml b/app-config.yaml index 4746e822da..a495df0263 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -232,6 +232,14 @@ auth: $env: AUTH_MICROSOFT_CLIENT_SECRET tenantId: $env: AUTH_MICROSOFT_TENANT_ID + onelogin: + development: + clientId: + $env: AUTH_ONELOGIN_CLIENT_ID + clientSecret: + $env: AUTH_ONELOGIN_CLIENT_SECRET + issuer: + $env: AUTH_ONELOGIN_ISSUER costInsights: engineerCost: 200000 products: diff --git a/packages/app/src/identityProviders.ts b/packages/app/src/identityProviders.ts index 388bc8d8b6..06ff6b07d3 100644 --- a/packages/app/src/identityProviders.ts +++ b/packages/app/src/identityProviders.ts @@ -21,6 +21,7 @@ import { githubAuthApiRef, samlAuthApiRef, microsoftAuthApiRef, + oneloginAuthApiRef, } from '@backstage/core'; export const providers = [ @@ -60,4 +61,10 @@ export const providers = [ message: 'Sign In using SAML', apiRef: samlAuthApiRef, }, + { + id: 'onelogin-auth-provider', + title: 'OneLogin', + message: 'Sign In using OneLogin', + apiRef: oneloginAuthApiRef, + }, ]; diff --git a/packages/core-api/src/apis/definitions/auth.ts b/packages/core-api/src/apis/definitions/auth.ts index 946baeabd9..c538065f3a 100644 --- a/packages/core-api/src/apis/definitions/auth.ts +++ b/packages/core-api/src/apis/definitions/auth.ts @@ -320,3 +320,14 @@ export const samlAuthApiRef: ApiRef< id: 'core.auth.saml', description: 'Example of how to use SAML custom provider', }); + +export const oneloginAuthApiRef: ApiRef< + OAuthApi & + OpenIdConnectApi & + ProfileInfoApi & + BackstageIdentityApi & + SessionApi +> = createApiRef({ + id: 'core.auth.onelogin', + description: 'Provides authentication towards OneLogin APIs and identities', +}); diff --git a/packages/core-api/src/apis/implementations/auth/index.ts b/packages/core-api/src/apis/implementations/auth/index.ts index 39223e8e15..7ef78d19cf 100644 --- a/packages/core-api/src/apis/implementations/auth/index.ts +++ b/packages/core-api/src/apis/implementations/auth/index.ts @@ -22,3 +22,4 @@ export * from './okta'; export * from './saml'; export * from './auth0'; export * from './microsoft'; +export * from './onelogin'; diff --git a/packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts b/packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts new file mode 100644 index 0000000000..d6b1a07d9d --- /dev/null +++ b/packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts @@ -0,0 +1,61 @@ +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import OktaAuth from './OktaAuth'; +import MockOAuthApi from '../../OAuthRequestApi/MockOAuthApi'; +import { UrlPatternDiscovery } from '../../DiscoveryApi'; + +const PREFIX = 'okta.'; + +const getSession = jest.fn(); + +jest.mock('../../../../lib/AuthSessionManager', () => ({ + ...(jest.requireActual('../../../../lib/AuthSessionManager') as any), + RefreshingAuthSessionManager: class { + getSession = getSession; + }, +})); + +describe('OktaAuth', () => { + afterEach(() => { + jest.resetAllMocks(); + }); + + it.each([ + ['openid', ['openid']], + ['profile email', ['profile', 'email']], + [`${PREFIX}groups.manage`, [`${PREFIX}groups.manage`]], + ['groups.read', [`${PREFIX}groups.read`]], + [ + `${PREFIX}groups.manage groups.read, openid`, + [`${PREFIX}groups.manage`, `${PREFIX}groups.read`, 'openid'], + ], + [`email\t ${PREFIX}groups.read`, ['email', `${PREFIX}groups.read`]], + + // Some incorrect scopes that we don't try to fix + [`${PREFIX}email`, [`${PREFIX}email`]], + [`${PREFIX}profile`, [`${PREFIX}profile`]], + [`${PREFIX}openid`, [`${PREFIX}openid`]], + ])(`should normalize scopes correctly - %p`, (scope, scopes) => { + const auth = OktaAuth.create({ + oauthRequestApi: new MockOAuthApi(), + discoveryApi: UrlPatternDiscovery.compile('http://example.com'), + }); + + auth.getAccessToken(scope); + expect(getSession).toHaveBeenCalledWith({ scopes: new Set(scopes) }); + }); +}); diff --git a/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts b/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts new file mode 100644 index 0000000000..7420b21510 --- /dev/null +++ b/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts @@ -0,0 +1,82 @@ +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import OneLoginIcon from '@material-ui/icons/AcUnit'; +import { oneloginAuthApiRef } from '@backstage/core-api/src/apis/definitions/auth'; +import { + OAuthRequestApi, + AuthProvider, + DiscoveryApi, +} from '@backstage/core-api/src/apis/definitions'; +import { OAuth2 } from '@backstage/core-api/src/apis/implementations/auth/oauth2'; + +type CreateOptions = { + discoveryApi: DiscoveryApi; + oauthRequestApi: OAuthRequestApi; + + environment?: string; + provider?: AuthProvider & { id: string }; +}; + +const DEFAULT_PROVIDER = { + id: 'onelogin', + title: 'onelogin', + icon: OneLoginIcon, +}; + +const OIDC_SCOPES: Set = new Set([ + 'openid', + 'profile', + 'email', + 'phone', + 'address', + 'groups', + 'offline_access', +]); + +const SCOPE_PREFIX: string = 'onelogin.'; + +class OneLoginAuth { + static create({ + discoveryApi, + environment = 'development', + provider = DEFAULT_PROVIDER, + oauthRequestApi, + }: CreateOptions): typeof oneloginAuthApiRef.T { + return OAuth2.create({ + discoveryApi, + oauthRequestApi, + provider, + environment, + defaultScopes: ['openid', 'email', 'profile', 'offline_access'], + scopeTransform(scopes) { + return scopes.map(scope => { + if (OIDC_SCOPES.has(scope)) { + return scope; + } + + if (scope.startsWith(SCOPE_PREFIX)) { + return scope; + } + + return `${SCOPE_PREFIX}${scope}`; + }); + }, + }); + } +} + +export default OneLoginAuth; diff --git a/packages/core-api/src/apis/implementations/auth/onelogin/index.ts b/packages/core-api/src/apis/implementations/auth/onelogin/index.ts new file mode 100644 index 0000000000..1d163207db --- /dev/null +++ b/packages/core-api/src/apis/implementations/auth/onelogin/index.ts @@ -0,0 +1,17 @@ +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +export { default as OneLoginAuth } from './OneLoginAuth'; diff --git a/packages/core/src/api-wrappers/defaultApis.ts b/packages/core/src/api-wrappers/defaultApis.ts index d0a777dc94..61d4f3a7e1 100644 --- a/packages/core/src/api-wrappers/defaultApis.ts +++ b/packages/core/src/api-wrappers/defaultApis.ts @@ -44,6 +44,8 @@ import { UrlPatternDiscovery, samlAuthApiRef, SamlAuth, + oneloginAuthApiRef, + OneLoginAuth, } from '@backstage/core-api'; export const defaultApis = [ @@ -142,4 +144,13 @@ export const defaultApis = [ }, factory: ({ discoveryApi }) => SamlAuth.create({ discoveryApi }), }), + createApiFactory({ + api: oneloginAuthApiRef, + deps: { + discoveryApi: discoveryApiRef, + oauthRequestApi: oauthRequestApiRef, + }, + factory: ({ discoveryApi, oauthRequestApi }) => + OneLoginAuth.create({ discoveryApi, oauthRequestApi }), + }), ]; diff --git a/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts b/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts index 3264fd8faa..28f15ee9e8 100644 --- a/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts +++ b/plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts @@ -116,7 +116,6 @@ export const executeFrameHandlerStrategy = async ( strategy.redirect = () => { reject(new Error('Unexpected redirect')); }; - strategy.authenticate(req, {}); }, ); diff --git a/plugins/auth-backend/src/providers/factories.ts b/plugins/auth-backend/src/providers/factories.ts index 37761c2305..a764d0b50e 100644 --- a/plugins/auth-backend/src/providers/factories.ts +++ b/plugins/auth-backend/src/providers/factories.ts @@ -22,6 +22,7 @@ import { createOktaProvider } from './okta'; import { createSamlProvider } from './saml'; import { createAuth0Provider } from './auth0'; import { createMicrosoftProvider } from './microsoft'; +import { createOneLoginProvider } from './onelogin'; import { AuthProviderFactory, AuthProviderFactoryOptions } from './types'; const factories: { [providerId: string]: AuthProviderFactory } = { @@ -33,6 +34,7 @@ const factories: { [providerId: string]: AuthProviderFactory } = { auth0: createAuth0Provider, microsoft: createMicrosoftProvider, oauth2: createOAuth2Provider, + onelogin: createOneLoginProvider, }; export function createAuthProvider( diff --git a/plugins/auth-backend/src/providers/onelogin/index.ts b/plugins/auth-backend/src/providers/onelogin/index.ts new file mode 100644 index 0000000000..4c110c56ac --- /dev/null +++ b/plugins/auth-backend/src/providers/onelogin/index.ts @@ -0,0 +1 @@ +export { createOneLoginProvider } from './provider'; \ No newline at end of file diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts new file mode 100644 index 0000000000..a9b43fc8d4 --- /dev/null +++ b/plugins/auth-backend/src/providers/onelogin/provider.ts @@ -0,0 +1,160 @@ +//import { Strategy as OneLoginStrategy } from 'passport-openidconnect'; +import { Strategy as OneLoginStrategy } from 'passport-onelogin'; +import express from 'express'; +import { + OAuthAdapter, + OAuthProviderOptions, + OAuthHandlers, + OAuthResponse, + OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, + OAuthRefreshRequest, +} from '../../lib/oauth'; +import passport from 'passport'; +import { + executeFrameHandlerStrategy, + executeRedirectStrategy, + executeRefreshTokenStrategy, + makeProfileInfo, + executeFetchUserProfileStrategy, + PassportDoneCallback, +} from '../../lib/passport'; +import { RedirectInfo, AuthProviderFactory } from '../types'; + +type PrivateInfo = { + refreshToken: string; +}; + +export type OneLoginProviderOptions = OAuthProviderOptions & { + issuer: string +} + +export class OneLoginProvider implements OAuthHandlers { + private readonly _strategy: any; + + constructor(options: OneLoginProviderOptions) { + this._strategy = new OneLoginStrategy( + { + issuer: options.issuer, + clientID: options.clientId, + clientSecret: options.clientSecret, + callbackURL: options.callbackUrl, + passReqToCallback: false as true, + }, + ( + accessToken: any, + refreshToken: any, + params: any, + rawProfile: passport.Profile, + done: PassportDoneCallback, + ) => { + const profile = makeProfileInfo(rawProfile, params.id_token); + + done( + undefined, + { + providerInfo: { + idToken: params.id_token, + accessToken, + scope: params.scope, + //scope: 'profile', + expiresInSeconds: params.expires_in, + }, + profile, + }, + { + refreshToken, + }, + ); + }, + ); + } + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { + accessType: 'offline', + prompt: 'consent', + scope: 'openid', + state: encodeState(req.state), + }); + } + + async handler( + req: express.Request, + ): Promise<{ response: OAuthResponse; refreshToken: string }> { + const { response, privateInfo } = await executeFrameHandlerStrategy< + OAuthResponse, + PrivateInfo + >(req, this._strategy); + + return { + response: await this.populateIdentity(response), + refreshToken: privateInfo.refreshToken, + }; + } + + async refresh(req: OAuthRefreshRequest): Promise { + const { accessToken, params } = await executeRefreshTokenStrategy( + this._strategy, + req.refreshToken, + req.scope, + ); + + const profile = await executeFetchUserProfileStrategy( + this._strategy, + accessToken, + params.id_token, + ); + + return this.populateIdentity({ + providerInfo: { + accessToken, + idToken: params.id_token, + expiresInSeconds: params.expires_in, + scope: params.scope, + }, + profile, + }); + } + + private async populateIdentity( + response: OAuthResponse, + ): Promise { + const { profile } = response; + + if (!profile.email) { + throw new Error('OIDC profile contained no email'); + } + + const id = profile.email.split('@')[0]; + + return { ...response, backstageIdentity: { id } }; + } +} + + +export const createOneLoginProvider: AuthProviderFactory = ({ + globalConfig, + config, + tokenIssuer, +}) => + OAuthEnvironmentHandler.mapConfig(config, envConfig => { + const providerId = 'onelogin'; + const clientId = envConfig.getString('clientId'); + const clientSecret = envConfig.getString('clientSecret'); + const issuer = envConfig.getString('issuer'); + const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; + + const provider = new OneLoginProvider({ + clientId, + clientSecret, + callbackUrl, + issuer, + }); + + return OAuthAdapter.fromConfig(globalConfig, provider, { + disableRefresh: false, + providerId, + tokenIssuer, + }); + }); diff --git a/plugins/auth-backend/src/providers/onelogin/types.d.ts b/plugins/auth-backend/src/providers/onelogin/types.d.ts new file mode 100644 index 0000000000..bff5a7e33c --- /dev/null +++ b/plugins/auth-backend/src/providers/onelogin/types.d.ts @@ -0,0 +1,20 @@ +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +declare module 'passport-openidconnect' { + export class Strategy { + constructor(options: any, verify: any); + } +} From 159f5ee77c5042eb84acce2d5563eef9ca214df0 Mon Sep 17 00:00:00 2001 From: Forrest Waters Date: Wed, 28 Oct 2020 19:18:13 -0500 Subject: [PATCH 2/6] add passport-onelogin dependency --- .../auth/onelogin/OktaAuth.test.ts | 61 ------------------- plugins/auth-backend/package.json | 1 + yarn.lock | 9 +++ 3 files changed, 10 insertions(+), 61 deletions(-) delete mode 100644 packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts diff --git a/packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts b/packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts deleted file mode 100644 index d6b1a07d9d..0000000000 --- a/packages/core-api/src/apis/implementations/auth/onelogin/OktaAuth.test.ts +++ /dev/null @@ -1,61 +0,0 @@ -/* - * Copyright 2020 Spotify AB - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -import OktaAuth from './OktaAuth'; -import MockOAuthApi from '../../OAuthRequestApi/MockOAuthApi'; -import { UrlPatternDiscovery } from '../../DiscoveryApi'; - -const PREFIX = 'okta.'; - -const getSession = jest.fn(); - -jest.mock('../../../../lib/AuthSessionManager', () => ({ - ...(jest.requireActual('../../../../lib/AuthSessionManager') as any), - RefreshingAuthSessionManager: class { - getSession = getSession; - }, -})); - -describe('OktaAuth', () => { - afterEach(() => { - jest.resetAllMocks(); - }); - - it.each([ - ['openid', ['openid']], - ['profile email', ['profile', 'email']], - [`${PREFIX}groups.manage`, [`${PREFIX}groups.manage`]], - ['groups.read', [`${PREFIX}groups.read`]], - [ - `${PREFIX}groups.manage groups.read, openid`, - [`${PREFIX}groups.manage`, `${PREFIX}groups.read`, 'openid'], - ], - [`email\t ${PREFIX}groups.read`, ['email', `${PREFIX}groups.read`]], - - // Some incorrect scopes that we don't try to fix - [`${PREFIX}email`, [`${PREFIX}email`]], - [`${PREFIX}profile`, [`${PREFIX}profile`]], - [`${PREFIX}openid`, [`${PREFIX}openid`]], - ])(`should normalize scopes correctly - %p`, (scope, scopes) => { - const auth = OktaAuth.create({ - oauthRequestApi: new MockOAuthApi(), - discoveryApi: UrlPatternDiscovery.compile('http://example.com'), - }); - - auth.getAccessToken(scope); - expect(getSession).toHaveBeenCalledWith({ scopes: new Set(scopes) }); - }); -}); diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index 6489c8547d..7266395c78 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -45,6 +45,7 @@ "passport-microsoft": "^0.1.0", "passport-oauth2": "^1.5.0", "passport-okta-oauth": "^0.0.1", + "passport-onelogin-oauth": "^0.0.1", "passport-saml": "^1.3.3", "uuid": "^8.0.0", "winston": "^3.2.1", diff --git a/yarn.lock b/yarn.lock index b2b87be5e0..4d1a4cd856 100644 --- a/yarn.lock +++ b/yarn.lock @@ -17915,6 +17915,15 @@ passport-okta-oauth@^0.0.1: pkginfo "0.2.x" uid2 "0.0.3" +passport-onelogin-oauth@^0.0.1: + version "0.0.1" + resolved "https://registry.npmjs.org/passport-onelogin-oauth/-/passport-onelogin-oauth-0.0.1.tgz#6e991ac6720783fdd80d4caa08c36cc71ef19962" + integrity sha512-EXFBqlJdHf5AX4QaiZsLfhgQUOR6z3zGA5479SUJF4I4rnAt7yasZEbs27pg8MRiQh/uLZEWLGMoVXr6LHV9mQ== + dependencies: + passport-oauth "1.0.0" + pkginfo "0.2.x" + uid2 "0.0.3" + passport-saml@^1.3.3: version "1.3.3" resolved "https://registry.npmjs.org/passport-saml/-/passport-saml-1.3.3.tgz#cbea1a2b21ff32b3bc4bfd84dc39c3a370df9935" From 11664e3a99c79e95f92ec60ad681ca8849e282ea Mon Sep 17 00:00:00 2001 From: Forrest Waters Date: Wed, 28 Oct 2020 19:34:02 -0500 Subject: [PATCH 3/6] run prettier --- plugins/auth-backend/src/providers/onelogin/index.ts | 2 +- plugins/auth-backend/src/providers/onelogin/provider.ts | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/plugins/auth-backend/src/providers/onelogin/index.ts b/plugins/auth-backend/src/providers/onelogin/index.ts index 4c110c56ac..c356ef2d6d 100644 --- a/plugins/auth-backend/src/providers/onelogin/index.ts +++ b/plugins/auth-backend/src/providers/onelogin/index.ts @@ -1 +1 @@ -export { createOneLoginProvider } from './provider'; \ No newline at end of file +export { createOneLoginProvider } from './provider'; diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts index a9b43fc8d4..bafc0c61ca 100644 --- a/plugins/auth-backend/src/providers/onelogin/provider.ts +++ b/plugins/auth-backend/src/providers/onelogin/provider.ts @@ -27,8 +27,8 @@ type PrivateInfo = { }; export type OneLoginProviderOptions = OAuthProviderOptions & { - issuer: string -} + issuer: string; +}; export class OneLoginProvider implements OAuthHandlers { private readonly _strategy: any; @@ -132,7 +132,6 @@ export class OneLoginProvider implements OAuthHandlers { } } - export const createOneLoginProvider: AuthProviderFactory = ({ globalConfig, config, From b652bf2cc58ae56e34a73d4f74f25904d53ab61e Mon Sep 17 00:00:00 2001 From: Forrest Waters Date: Wed, 28 Oct 2020 19:48:21 -0500 Subject: [PATCH 4/6] add changeset for onelogin --- .changeset/beige-pandas-thank.md | 5 +++++ .../src/providers/onelogin/index.ts | 16 ++++++++++++++++ .../src/providers/onelogin/provider.ts | 19 +++++++++++++++++-- .../src/providers/onelogin/types.d.ts | 2 +- 4 files changed, 39 insertions(+), 3 deletions(-) create mode 100644 .changeset/beige-pandas-thank.md diff --git a/.changeset/beige-pandas-thank.md b/.changeset/beige-pandas-thank.md new file mode 100644 index 0000000000..b2c52842fc --- /dev/null +++ b/.changeset/beige-pandas-thank.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Add OneLogin Identity Provider to Auth Backend diff --git a/plugins/auth-backend/src/providers/onelogin/index.ts b/plugins/auth-backend/src/providers/onelogin/index.ts index c356ef2d6d..79af226cd1 100644 --- a/plugins/auth-backend/src/providers/onelogin/index.ts +++ b/plugins/auth-backend/src/providers/onelogin/index.ts @@ -1 +1,17 @@ +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + export { createOneLoginProvider } from './provider'; diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts index bafc0c61ca..d11baa605d 100644 --- a/plugins/auth-backend/src/providers/onelogin/provider.ts +++ b/plugins/auth-backend/src/providers/onelogin/provider.ts @@ -1,5 +1,20 @@ -//import { Strategy as OneLoginStrategy } from 'passport-openidconnect'; -import { Strategy as OneLoginStrategy } from 'passport-onelogin'; +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import { Strategy as OneLoginStrategy } from 'passport-onelogin-oauth'; import express from 'express'; import { OAuthAdapter, diff --git a/plugins/auth-backend/src/providers/onelogin/types.d.ts b/plugins/auth-backend/src/providers/onelogin/types.d.ts index bff5a7e33c..d418f1bcd4 100644 --- a/plugins/auth-backend/src/providers/onelogin/types.d.ts +++ b/plugins/auth-backend/src/providers/onelogin/types.d.ts @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -declare module 'passport-openidconnect' { +declare module 'passport-onelogin-oauth' { export class Strategy { constructor(options: any, verify: any); } From 842acf4f5d95915bae902c89650a22573aafd596 Mon Sep 17 00:00:00 2001 From: Forrest Waters Date: Wed, 28 Oct 2020 19:56:05 -0500 Subject: [PATCH 5/6] remove commented code --- plugins/auth-backend/src/providers/onelogin/provider.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/plugins/auth-backend/src/providers/onelogin/provider.ts b/plugins/auth-backend/src/providers/onelogin/provider.ts index d11baa605d..97cf182e5a 100644 --- a/plugins/auth-backend/src/providers/onelogin/provider.ts +++ b/plugins/auth-backend/src/providers/onelogin/provider.ts @@ -73,7 +73,6 @@ export class OneLoginProvider implements OAuthHandlers { idToken: params.id_token, accessToken, scope: params.scope, - //scope: 'profile', expiresInSeconds: params.expires_in, }, profile, From 05b0ed81f543a2eac67606bb4ad225b0d2b95d30 Mon Sep 17 00:00:00 2001 From: Forrest Waters Date: Thu, 29 Oct 2020 12:02:29 -0500 Subject: [PATCH 6/6] fix imports --- .../src/apis/implementations/auth/onelogin/OneLoginAuth.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts b/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts index 7420b21510..ff5c7c1990 100644 --- a/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts +++ b/packages/core-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts @@ -15,13 +15,13 @@ */ import OneLoginIcon from '@material-ui/icons/AcUnit'; -import { oneloginAuthApiRef } from '@backstage/core-api/src/apis/definitions/auth'; +import { oneloginAuthApiRef } from '../../../definitions/auth'; import { OAuthRequestApi, AuthProvider, DiscoveryApi, -} from '@backstage/core-api/src/apis/definitions'; -import { OAuth2 } from '@backstage/core-api/src/apis/implementations/auth/oauth2'; +} from '../../../definitions'; +import { OAuth2 } from '../oauth2'; type CreateOptions = { discoveryApi: DiscoveryApi;