From 4611d59fdc4829a1c8a23df5536e76cee2cca1b2 Mon Sep 17 00:00:00 2001 From: Alex Krantz Date: Sat, 9 Oct 2021 17:29:13 -0700 Subject: [PATCH 1/3] fix: require https for Okta audience URL Signed-off-by: Alex Krantz --- plugins/auth-backend/src/providers/okta/provider.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 44e26bb7fe..7ea5b29e80 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -275,6 +275,10 @@ export const createOktaProvider = ( const audience = envConfig.getString('audience'); const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; + if (!audience.startsWith('https')) { + throw new Error("URL for 'audience' must start with 'https'."); + } + const catalogIdentityClient = new CatalogIdentityClient({ catalogApi, tokenIssuer, From 9322e632e9c7d9f5ebe46871ec371bb9f1e248be Mon Sep 17 00:00:00 2001 From: Alex Krantz Date: Sat, 9 Oct 2021 17:35:57 -0700 Subject: [PATCH 2/3] chore: add changeset Signed-off-by: Alex Krantz --- .changeset/blue-dingos-repeat.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/blue-dingos-repeat.md diff --git a/.changeset/blue-dingos-repeat.md b/.changeset/blue-dingos-repeat.md new file mode 100644 index 0000000000..111a94a00b --- /dev/null +++ b/.changeset/blue-dingos-repeat.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Require that audience URLs for Okta authentication start with https From e2039ef99a0391bf01b9fd5be9fdccc1a04a9fa5 Mon Sep 17 00:00:00 2001 From: Alex Krantz Date: Tue, 12 Oct 2021 10:28:42 -0700 Subject: [PATCH 3/3] fix: add comment for clarification and require full scheme Signed-off-by: Alex Krantz --- plugins/auth-backend/src/providers/okta/provider.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 7ea5b29e80..dfffca9da7 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -275,8 +275,11 @@ export const createOktaProvider = ( const audience = envConfig.getString('audience'); const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; - if (!audience.startsWith('https')) { - throw new Error("URL for 'audience' must start with 'https'."); + // This is a safe assumption as `passport-okta-oauth` uses the audience + // as the base for building the authorization, token, and user info URLs. + // https://github.com/fischerdan/passport-okta-oauth/blob/ea9ac42d/lib/passport-okta-oauth/oauth2.js#L12-L14 + if (!audience.startsWith('https://')) { + throw new Error("URL for 'audience' must start with 'https://'."); } const catalogIdentityClient = new CatalogIdentityClient({