From 037447efd3272693bf3a834c6342eb2de3cf2565 Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Mon, 11 Oct 2021 15:04:59 -0400 Subject: [PATCH 01/14] adds atlassian auth provider Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- packages/app/src/identityProviders.ts | 7 + .../auth/atlassian/AtlassianAuth.ts | 44 +++ .../implementations/auth/atlassian/index.ts | 17 ++ .../src/apis/implementations/auth/index.ts | 1 + packages/core-app-api/src/app/defaultApis.ts | 17 ++ .../src/apis/definitions/auth.ts | 12 + .../src/providers/atlassian/index.ts | 18 ++ .../src/providers/atlassian/provider.test.ts | 96 +++++++ .../src/providers/atlassian/provider.ts | 271 ++++++++++++++++++ .../src/providers/atlassian/strategy.ts | 111 +++++++ .../auth-backend/src/providers/factories.ts | 2 + plugins/auth-backend/src/providers/index.ts | 1 + .../AuthProviders/DefaultProviderSettings.tsx | 9 + 13 files changed, 606 insertions(+) create mode 100644 packages/core-app-api/src/apis/implementations/auth/atlassian/AtlassianAuth.ts create mode 100644 packages/core-app-api/src/apis/implementations/auth/atlassian/index.ts create mode 100644 plugins/auth-backend/src/providers/atlassian/index.ts create mode 100644 plugins/auth-backend/src/providers/atlassian/provider.test.ts create mode 100644 plugins/auth-backend/src/providers/atlassian/provider.ts create mode 100644 plugins/auth-backend/src/providers/atlassian/strategy.ts diff --git a/packages/app/src/identityProviders.ts b/packages/app/src/identityProviders.ts index 49204d2b5e..70630a3d0a 100644 --- a/packages/app/src/identityProviders.ts +++ b/packages/app/src/identityProviders.ts @@ -25,6 +25,7 @@ import { oauth2ApiRef, oidcAuthApiRef, bitbucketAuthApiRef, + atlassianAuthApiRef, } from '@backstage/core-plugin-api'; export const providers = [ @@ -88,4 +89,10 @@ export const providers = [ message: 'Sign In using Bitbucket', apiRef: bitbucketAuthApiRef, }, + { + id: 'atlassian-auth-provider', + title: 'Atlassian', + message: 'Sign In using Atlassian', + apiRef: atlassianAuthApiRef, + }, ]; diff --git a/packages/core-app-api/src/apis/implementations/auth/atlassian/AtlassianAuth.ts b/packages/core-app-api/src/apis/implementations/auth/atlassian/AtlassianAuth.ts new file mode 100644 index 0000000000..423c45bc6c --- /dev/null +++ b/packages/core-app-api/src/apis/implementations/auth/atlassian/AtlassianAuth.ts @@ -0,0 +1,44 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import AtlassianIcon from '@material-ui/icons/AcUnit'; +import { atlassianAuthApiRef } from '@backstage/core-plugin-api'; +import { OAuth2 } from '../oauth2'; +import { OAuthApiCreateOptions } from '../types'; + +const DEFAULT_PROVIDER = { + id: 'atlassian', + title: 'Atlassian', + icon: AtlassianIcon, +}; + +class AtlassianAuth { + static create({ + discoveryApi, + environment = 'development', + provider = DEFAULT_PROVIDER, + oauthRequestApi, + }: OAuthApiCreateOptions): typeof atlassianAuthApiRef.T { + return OAuth2.create({ + discoveryApi, + oauthRequestApi, + provider, + environment, + }); + } +} + +export default AtlassianAuth; diff --git a/packages/core-app-api/src/apis/implementations/auth/atlassian/index.ts b/packages/core-app-api/src/apis/implementations/auth/atlassian/index.ts new file mode 100644 index 0000000000..fb787be1ce --- /dev/null +++ b/packages/core-app-api/src/apis/implementations/auth/atlassian/index.ts @@ -0,0 +1,17 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +export { default as AtlassianAuth } from './AtlassianAuth'; diff --git a/packages/core-app-api/src/apis/implementations/auth/index.ts b/packages/core-app-api/src/apis/implementations/auth/index.ts index b622b90b8c..bbc9d23ccc 100644 --- a/packages/core-app-api/src/apis/implementations/auth/index.ts +++ b/packages/core-app-api/src/apis/implementations/auth/index.ts @@ -24,3 +24,4 @@ export * from './auth0'; export * from './microsoft'; export * from './onelogin'; export * from './bitbucket'; +export * from './atlassian'; diff --git a/packages/core-app-api/src/app/defaultApis.ts b/packages/core-app-api/src/app/defaultApis.ts index 5e850f4cce..fb02274cf0 100644 --- a/packages/core-app-api/src/app/defaultApis.ts +++ b/packages/core-app-api/src/app/defaultApis.ts @@ -33,6 +33,7 @@ import { SamlAuth, OneLoginAuth, UnhandledErrorForwarder, + AtlassianAuth, } from '../apis'; import { @@ -55,6 +56,7 @@ import { oneloginAuthApiRef, oidcAuthApiRef, bitbucketAuthApiRef, + atlassianAuthApiRef, } from '@backstage/core-plugin-api'; import OAuth2Icon from '@material-ui/icons/AcUnit'; @@ -244,4 +246,19 @@ export const defaultApis = [ environment: configApi.getOptionalString('auth.environment'), }), }), + createApiFactory({ + api: atlassianAuthApiRef, + deps: { + discoveryApi: discoveryApiRef, + oauthRequestApi: oauthRequestApiRef, + configApi: configApiRef, + }, + factory: ({ discoveryApi, oauthRequestApi, configApi }) => { + return AtlassianAuth.create({ + discoveryApi, + oauthRequestApi, + environment: configApi.getOptionalString('auth.environment'), + }); + }, + }), ]; diff --git a/packages/core-plugin-api/src/apis/definitions/auth.ts b/packages/core-plugin-api/src/apis/definitions/auth.ts index a78414048c..f67614b758 100644 --- a/packages/core-plugin-api/src/apis/definitions/auth.ts +++ b/packages/core-plugin-api/src/apis/definitions/auth.ts @@ -352,3 +352,15 @@ export const bitbucketAuthApiRef: ApiRef< > = createApiRef({ id: 'core.auth.bitbucket', }); + +/** + * Provides authentication towards Atlassian APIs. + * + * See https://developer.atlassian.com/cloud/jira/platform/scopes-for-connect-and-oauth-2-3LO-apps/ + * for a full list of supported scopes. + */ +export const atlassianAuthApiRef: ApiRef< + OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionApi +> = createApiRef({ + id: 'core.auth.atlassian', +}); diff --git a/plugins/auth-backend/src/providers/atlassian/index.ts b/plugins/auth-backend/src/providers/atlassian/index.ts new file mode 100644 index 0000000000..b99b63d7bc --- /dev/null +++ b/plugins/auth-backend/src/providers/atlassian/index.ts @@ -0,0 +1,18 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +export { createAtlassianProvider } from './provider'; +export type { AtlassianAuthProvider } from './provider'; diff --git a/plugins/auth-backend/src/providers/atlassian/provider.test.ts b/plugins/auth-backend/src/providers/atlassian/provider.test.ts new file mode 100644 index 0000000000..e561c2e037 --- /dev/null +++ b/plugins/auth-backend/src/providers/atlassian/provider.test.ts @@ -0,0 +1,96 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import { AtlassianAuthProvider } from './provider'; +import * as helpers from '../../lib/passport/PassportStrategyHelper'; +import { getVoidLogger } from '@backstage/backend-common'; +import { TokenIssuer } from '../../identity'; +import { CatalogIdentityClient } from '../../lib/catalog'; +import { OAuthResult } from '../../lib/oauth'; + +const mockFrameHandler = jest.spyOn( + helpers, + 'executeFrameHandlerStrategy', +) as unknown as jest.MockedFunction<() => Promise<{ result: OAuthResult }>>; + +describe('createAtlassianProvider', () => { + it('should auth', async () => { + const tokenIssuer = { + issueToken: jest.fn(), + listPublicKeys: jest.fn(), + }; + const catalogIdentityClient = { + findUser: jest.fn(), + }; + + const provider = new AtlassianAuthProvider({ + logger: getVoidLogger(), + catalogIdentityClient: + catalogIdentityClient as unknown as CatalogIdentityClient, + tokenIssuer: tokenIssuer as unknown as TokenIssuer, + authHandler: async ({ fullProfile }) => ({ + profile: { + email: fullProfile.emails![0]!.value, + displayName: fullProfile.displayName, + picture: 'http://google.com/lols', + }, + }), + clientId: 'mock', + clientSecret: 'mock', + callbackUrl: 'mock', + scopes: [], + }); + + mockFrameHandler.mockResolvedValueOnce({ + result: { + fullProfile: { + photos: [ + { + value: + 'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg', + }, + ], + emails: [{ value: 'conrad@example.com' }], + displayName: 'Conrad', + id: 'conrad', + provider: 'google', + }, + params: { + id_token: 'idToken', + scope: 'scope', + expires_in: 123, + }, + accessToken: 'accessToken', + refreshToken: 'wacka', + }, + }); + const { response } = await provider.handler({} as any); + expect(response).toEqual({ + providerInfo: { + accessToken: 'accessToken', + expiresInSeconds: 123, + idToken: 'idToken', + scope: 'scope', + refreshToken: 'wacka', + }, + profile: { + email: 'conrad@example.com', + displayName: 'Conrad', + picture: 'http://google.com/lols', + }, + }); + }); +}); diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts new file mode 100644 index 0000000000..a4ab5600e1 --- /dev/null +++ b/plugins/auth-backend/src/providers/atlassian/provider.ts @@ -0,0 +1,271 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import AtlassianStrategy from './strategy'; +import { + encodeState, + OAuthAdapter, + OAuthEnvironmentHandler, + OAuthHandlers, + OAuthProviderOptions, + OAuthRefreshRequest, + OAuthResponse, + OAuthResult, + OAuthStartRequest, +} from '../../lib/oauth'; +import passport from 'passport'; +import { + executeFetchUserProfileStrategy, + executeFrameHandlerStrategy, + executeRedirectStrategy, + executeRefreshTokenStrategy, + makeProfileInfo, + PassportDoneCallback, +} from '../../lib/passport'; +import { + AuthHandler, + AuthProviderFactory, + RedirectInfo, + SignInResolver, +} from '../types'; +import express from 'express'; +import { TokenIssuer } from '../../identity'; +import { CatalogIdentityClient } from '../../lib/catalog'; +import { Logger } from 'winston'; + +export type AtlassianAuthProviderOptions = OAuthProviderOptions & { + scopes: string[]; + signInResolver?: SignInResolver; + authHandler: AuthHandler; + tokenIssuer: TokenIssuer; + catalogIdentityClient: CatalogIdentityClient; + logger: Logger; +}; + +export const atlassianDefaultSignInResolver: SignInResolver = + async (info, ctx) => { + const { profile, result } = info; + + let id = result.fullProfile.id; + + if (profile.email) { + id = profile.email.split('@')[0]; + } + + const token = await ctx.tokenIssuer.issueToken({ + claims: { sub: id, ent: [`user:default/${id}`] }, + }); + + return { id, token }; + }; + +export const atlassianDefaultAuthHandler: AuthHandler = async ({ + fullProfile, + params, +}) => ({ + profile: makeProfileInfo(fullProfile, params.id_token), +}); + +export class AtlassianAuthProvider implements OAuthHandlers { + private readonly _strategy: AtlassianStrategy; + private readonly signInResolver?: SignInResolver; + private readonly authHandler: AuthHandler; + private readonly tokenIssuer: TokenIssuer; + private readonly catalogIdentityClient: CatalogIdentityClient; + private readonly logger: Logger; + + constructor(options: AtlassianAuthProviderOptions) { + this.catalogIdentityClient = options.catalogIdentityClient; + this.logger = options.logger; + this.tokenIssuer = options.tokenIssuer; + this.authHandler = options.authHandler; + this.signInResolver = options.signInResolver; + + this._strategy = new AtlassianStrategy( + { + clientID: options.clientId, + clientSecret: options.clientSecret, + callbackURL: options.callbackUrl, + scope: options.scopes, + }, + ( + accessToken: any, + refreshToken: any, + params: any, + fullProfile: passport.Profile, + done: PassportDoneCallback, + ) => { + done(undefined, { + fullProfile, + accessToken, + refreshToken, + params, + }); + }, + ); + } + + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { + state: encodeState(req.state), + }); + } + + async handler( + req: express.Request, + ): Promise<{ response: OAuthResponse; refreshToken: string }> { + const { result } = await executeFrameHandlerStrategy( + req, + this._strategy, + ); + + return { + response: await this.handleResult(result), + refreshToken: result.refreshToken ?? '', + }; + } + + private async handleResult(result: OAuthResult): Promise { + const { profile } = await this.authHandler(result); + + const response: OAuthResponse = { + providerInfo: { + idToken: result.params.id_token, + accessToken: result.accessToken, + refreshToken: result.refreshToken, // GitLab expires the old refresh token when used + scope: result.params.scope, + expiresInSeconds: result.params.expires_in, + }, + profile, + }; + + if (this.signInResolver) { + response.backstageIdentity = await this.signInResolver( + { + result, + profile, + }, + { + tokenIssuer: this.tokenIssuer, + catalogIdentityClient: this.catalogIdentityClient, + logger: this.logger, + }, + ); + } + + return response; + } + + async refresh(req: OAuthRefreshRequest): Promise { + const { + accessToken, + params, + refreshToken: newRefreshToken, + } = await executeRefreshTokenStrategy( + this._strategy, + req.refreshToken, + req.scope, + ); + + const fullProfile = await executeFetchUserProfileStrategy( + this._strategy, + accessToken, + ); + + return this.handleResult({ + fullProfile, + params, + accessToken, + refreshToken: newRefreshToken, + }); + } +} + +export type AtlassianProviderOptions = { + /** + * The profile transformation function used to verify and convert the auth response + * into the profile that will be presented to the user. + */ + authHandler?: AuthHandler; + + /** + * Configure sign-in for this provider, without it the provider can not be used to sign users in. + */ + /** + * Maps an auth result to a Backstage identity for the user. + * + * Set to `'email'` to use the default email-based sign in resolver, which will search + * the catalog for a single user entity that has a matching `microsoft.com/email` annotation. + */ + signIn?: { + resolver?: SignInResolver; + }; +}; + +export const createAtlassianProvider = ( + options?: AtlassianProviderOptions, +): AuthProviderFactory => { + return ({ + providerId, + globalConfig, + config, + tokenIssuer, + catalogApi, + logger, + }) => + OAuthEnvironmentHandler.mapConfig(config, envConfig => { + const clientId = envConfig.getString('clientId'); + const clientSecret = envConfig.getString('clientSecret'); + const scopes = envConfig.getStringArray('scopes'); + const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; + + const catalogIdentityClient = new CatalogIdentityClient({ + catalogApi, + tokenIssuer, + }); + + const authHandler: AuthHandler = + options?.authHandler ?? atlassianDefaultAuthHandler; + + const signInResolverFn = + options?.signIn?.resolver ?? atlassianDefaultSignInResolver; + + const signInResolver: SignInResolver = info => + signInResolverFn(info, { + catalogIdentityClient, + tokenIssuer, + logger, + }); + + const provider = new AtlassianAuthProvider({ + clientId, + clientSecret, + scopes, + callbackUrl, + authHandler, + signInResolver, + catalogIdentityClient, + logger, + tokenIssuer, + }); + + return OAuthAdapter.fromConfig(globalConfig, provider, { + disableRefresh: true, + providerId, + tokenIssuer, + }); + }); +}; diff --git a/plugins/auth-backend/src/providers/atlassian/strategy.ts b/plugins/auth-backend/src/providers/atlassian/strategy.ts new file mode 100644 index 0000000000..630348b16d --- /dev/null +++ b/plugins/auth-backend/src/providers/atlassian/strategy.ts @@ -0,0 +1,111 @@ +/* + * Copyright 2020 The Backstage Authors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +import OAuth2Strategy, { InternalOAuthError } from 'passport-oauth2'; +import { Profile } from 'passport'; + +interface ProfileResponse { + account_id: string; + email: string; + name: string; + picture: string; + nickname: string; +} + +interface AtlassianStrategyOptions { + clientID: string; + clientSecret: string; + callbackURL: string; + scope: string[]; +} + +const defaultScopes = ['offline_access', 'read:me']; + +export default class AtlassianStrategy extends OAuth2Strategy { + private readonly profileURL: string; + + constructor( + options: AtlassianStrategyOptions, + verify: OAuth2Strategy.VerifyFunction, + ) { + if (!options.scope) { + throw new TypeError('Atlassian requires a scope option'); + } + + const optionsWithURLs = { + ...options, + authorizationURL: `https://auth.atlassian.com/authorize`, + tokenURL: `https://auth.atlassian.com/oauth/token`, + scope: Array.from(new Set([...defaultScopes, ...options.scope])), + }; + + super(optionsWithURLs, verify); + this.profileURL = 'https://api.atlassian.com/me'; + this.name = 'atlassian'; + + this._oauth2.useAuthorizationHeaderforGET(true); + } + + authorizationParams() { + return { + audience: 'api.atlassian.com', + prompt: 'consent', + }; + } + + userProfile( + accessToken: string, + done: (err?: Error | null, profile?: any) => void, + ): void { + this._oauth2.get(this.profileURL, accessToken, (err, body) => { + if (err) { + return done( + new InternalOAuthError( + 'Failed to fetch user profile', + err.statusCode, + ), + ); + } + + if (!body) { + return done( + new Error('Failed to fetch user profile, body cannot be empty'), + ); + } + + try { + const json = typeof body !== 'string' ? body.toString() : body; + const profile = AtlassianStrategy.parse(json); + return done(null, profile); + } catch (e) { + return done(new Error('Failed to parse user profile')); + } + }); + } + + static parse(json: string): Profile { + const resp = JSON.parse(json) as ProfileResponse; + + return { + id: resp.account_id, + provider: 'atlassian', + username: resp.nickname, + displayName: resp.name, + emails: [{ value: resp.email }], + photos: [{ value: resp.picture }], + }; + } +} diff --git a/plugins/auth-backend/src/providers/factories.ts b/plugins/auth-backend/src/providers/factories.ts index c4894f2757..42d3569815 100644 --- a/plugins/auth-backend/src/providers/factories.ts +++ b/plugins/auth-backend/src/providers/factories.ts @@ -27,6 +27,7 @@ import { createOneLoginProvider } from './onelogin'; import { AuthProviderFactory } from './types'; import { createAwsAlbProvider } from './aws-alb'; import { createBitbucketProvider } from './bitbucket'; +import { createAtlassianProvider } from './atlassian'; export const factories: { [providerId: string]: AuthProviderFactory } = { google: createGoogleProvider(), @@ -41,4 +42,5 @@ export const factories: { [providerId: string]: AuthProviderFactory } = { onelogin: createOneLoginProvider(), awsalb: createAwsAlbProvider(), bitbucket: createBitbucketProvider(), + atlassian: createAtlassianProvider(), }; diff --git a/plugins/auth-backend/src/providers/index.ts b/plugins/auth-backend/src/providers/index.ts index 90466a8094..8c5f05fefd 100644 --- a/plugins/auth-backend/src/providers/index.ts +++ b/plugins/auth-backend/src/providers/index.ts @@ -21,6 +21,7 @@ export * from './microsoft'; export * from './oauth2'; export * from './okta'; export * from './bitbucket'; +export * from './atlassian'; export { factories as defaultAuthProviderFactories } from './factories'; diff --git a/plugins/user-settings/src/components/AuthProviders/DefaultProviderSettings.tsx b/plugins/user-settings/src/components/AuthProviders/DefaultProviderSettings.tsx index 4b9cf9c783..8cfb3a7257 100644 --- a/plugins/user-settings/src/components/AuthProviders/DefaultProviderSettings.tsx +++ b/plugins/user-settings/src/components/AuthProviders/DefaultProviderSettings.tsx @@ -25,6 +25,7 @@ import { oktaAuthApiRef, microsoftAuthApiRef, bitbucketAuthApiRef, + atlassianAuthApiRef, } from '@backstage/core-plugin-api'; type Props = { @@ -89,6 +90,14 @@ export const DefaultProviderSettings = ({ configuredProviders }: Props) => ( icon={Star} /> )} + {configuredProviders.includes('atlassian') && ( + + )} {configuredProviders.includes('oauth2') && ( Date: Mon, 11 Oct 2021 16:45:50 -0400 Subject: [PATCH 02/14] updates scope configuration Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- app-config.yaml | 5 + .../src/providers/atlassian/provider.test.ts | 114 +++++++++++++----- .../src/providers/atlassian/provider.ts | 6 +- .../src/providers/atlassian/strategy.ts | 6 +- 4 files changed, 99 insertions(+), 32 deletions(-) diff --git a/app-config.yaml b/app-config.yaml index c24ac1701b..e1b648c472 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -364,6 +364,11 @@ auth: development: clientId: ${AUTH_BITBUCKET_CLIENT_ID} clientSecret: ${AUTH_BITBUCKET_CLIENT_SECRET} + atlassian: + development: + clientId: ${AUTH_ATLASSIAN_CLIENT_ID} + clientSecret: ${AUTH_ATLASSIAN_CLIENT_SECRET} + scopes: ${AUTH_ATLASSIAN_SCOPES} costInsights: engineerCost: 200000 products: diff --git a/plugins/auth-backend/src/providers/atlassian/provider.test.ts b/plugins/auth-backend/src/providers/atlassian/provider.test.ts index e561c2e037..58c7468246 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.test.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.test.ts @@ -14,12 +14,16 @@ * limitations under the License. */ -import { AtlassianAuthProvider } from './provider'; +import { + AtlassianAuthProvider, + atlassianDefaultSignInResolver, +} from './provider'; import * as helpers from '../../lib/passport/PassportStrategyHelper'; import { getVoidLogger } from '@backstage/backend-common'; import { TokenIssuer } from '../../identity'; import { CatalogIdentityClient } from '../../lib/catalog'; import { OAuthResult } from '../../lib/oauth'; +import { PassportProfile } from '../../lib/passport/types'; const mockFrameHandler = jest.spyOn( helpers, @@ -27,33 +31,34 @@ const mockFrameHandler = jest.spyOn( ) as unknown as jest.MockedFunction<() => Promise<{ result: OAuthResult }>>; describe('createAtlassianProvider', () => { + const tokenIssuer = { + issueToken: jest.fn(), + listPublicKeys: jest.fn(), + }; + const catalogIdentityClient = { + findUser: jest.fn(), + }; + + const provider = new AtlassianAuthProvider({ + logger: getVoidLogger(), + catalogIdentityClient: + catalogIdentityClient as unknown as CatalogIdentityClient, + tokenIssuer: tokenIssuer as unknown as TokenIssuer, + authHandler: async ({ fullProfile }) => ({ + profile: { + email: fullProfile.emails![0]!.value, + displayName: fullProfile.displayName, + picture: 'http://google.com/lols', + }, + }), + clientId: 'mock', + clientSecret: 'mock', + callbackUrl: 'mock', + scopes: [], + signInResolver: atlassianDefaultSignInResolver, + }); + it('should auth', async () => { - const tokenIssuer = { - issueToken: jest.fn(), - listPublicKeys: jest.fn(), - }; - const catalogIdentityClient = { - findUser: jest.fn(), - }; - - const provider = new AtlassianAuthProvider({ - logger: getVoidLogger(), - catalogIdentityClient: - catalogIdentityClient as unknown as CatalogIdentityClient, - tokenIssuer: tokenIssuer as unknown as TokenIssuer, - authHandler: async ({ fullProfile }) => ({ - profile: { - email: fullProfile.emails![0]!.value, - displayName: fullProfile.displayName, - picture: 'http://google.com/lols', - }, - }), - clientId: 'mock', - clientSecret: 'mock', - callbackUrl: 'mock', - scopes: [], - }); - mockFrameHandler.mockResolvedValueOnce({ result: { fullProfile: { @@ -79,6 +84,9 @@ describe('createAtlassianProvider', () => { }); const { response } = await provider.handler({} as any); expect(response).toEqual({ + backstageIdentity: { + id: 'conrad', + }, providerInfo: { accessToken: 'accessToken', expiresInSeconds: 123, @@ -93,4 +101,56 @@ describe('createAtlassianProvider', () => { }, }); }); + + it('should forward a new refresh token on refresh', async () => { + const mockRefreshToken = jest.spyOn( + helpers, + 'executeRefreshTokenStrategy', + ) as unknown as jest.MockedFunction<() => Promise<{}>>; + + mockRefreshToken.mockResolvedValueOnce({ + accessToken: 'a.b.c', + refreshToken: 'dont-forget-to-send-refresh', + params: { + id_token: 'my-id', + scope: 'read_user', + }, + }); + + const mockUserProfile = jest.spyOn( + helpers, + 'executeFetchUserProfileStrategy', + ) as unknown as jest.MockedFunction<() => Promise>; + + mockUserProfile.mockResolvedValueOnce({ + id: 'uid-my-id', + username: 'mockuser', + provider: 'atlassian', + displayName: 'Mocked User', + emails: [ + { + value: 'mockuser@gmail.com', + }, + ], + }); + + const response = await provider.refresh({} as any); + + expect(response).toEqual({ + backstageIdentity: { + id: 'mockuser', + }, + profile: { + displayName: 'Mocked User', + email: 'mockuser@gmail.com', + picture: 'http://google.com/lols', + }, + providerInfo: { + accessToken: 'a.b.c', + idToken: 'my-id', + refreshToken: 'dont-forget-to-send-refresh', + scope: 'read_user', + }, + }); + }); }); diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts index a4ab5600e1..c7d1a9590c 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.ts @@ -145,7 +145,7 @@ export class AtlassianAuthProvider implements OAuthHandlers { providerInfo: { idToken: result.params.id_token, accessToken: result.accessToken, - refreshToken: result.refreshToken, // GitLab expires the old refresh token when used + refreshToken: result.refreshToken, scope: result.params.scope, expiresInSeconds: result.params.expires_in, }, @@ -229,7 +229,7 @@ export const createAtlassianProvider = ( OAuthEnvironmentHandler.mapConfig(config, envConfig => { const clientId = envConfig.getString('clientId'); const clientSecret = envConfig.getString('clientSecret'); - const scopes = envConfig.getStringArray('scopes'); + const scopes = envConfig.getString('scopes'); const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`; const catalogIdentityClient = new CatalogIdentityClient({ @@ -253,7 +253,7 @@ export const createAtlassianProvider = ( const provider = new AtlassianAuthProvider({ clientId, clientSecret, - scopes, + scopes: [scopes], callbackUrl, authHandler, signInResolver, diff --git a/plugins/auth-backend/src/providers/atlassian/strategy.ts b/plugins/auth-backend/src/providers/atlassian/strategy.ts index 630348b16d..d07b09c5f8 100644 --- a/plugins/auth-backend/src/providers/atlassian/strategy.ts +++ b/plugins/auth-backend/src/providers/atlassian/strategy.ts @@ -29,7 +29,7 @@ interface AtlassianStrategyOptions { clientID: string; clientSecret: string; callbackURL: string; - scope: string[]; + scope: string; } const defaultScopes = ['offline_access', 'read:me']; @@ -45,11 +45,13 @@ export default class AtlassianStrategy extends OAuth2Strategy { throw new TypeError('Atlassian requires a scope option'); } + const scopes = options.scope.split(' '); + const optionsWithURLs = { ...options, authorizationURL: `https://auth.atlassian.com/authorize`, tokenURL: `https://auth.atlassian.com/oauth/token`, - scope: Array.from(new Set([...defaultScopes, ...options.scope])), + scope: Array.from(new Set([...defaultScopes, ...scopes])), }; super(optionsWithURLs, verify); From 202f3229277f51adfab919db94cdf1bc1351f40f Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Mon, 11 Oct 2021 17:06:50 -0400 Subject: [PATCH 03/14] chore: adds changeset Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- .changeset/swift-pugs-serve.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .changeset/swift-pugs-serve.md diff --git a/.changeset/swift-pugs-serve.md b/.changeset/swift-pugs-serve.md new file mode 100644 index 0000000000..e6f1945afb --- /dev/null +++ b/.changeset/swift-pugs-serve.md @@ -0,0 +1,13 @@ +--- +'example-app': patch +'@backstage/core-app-api': patch +'@backstage/core-plugin-api': patch +'@backstage/plugin-auth-backend': patch +'@backstage/plugin-user-settings': patch +--- + +Atlassian Cloud authentication + +- AtlassianAuth added to core-app-api +- Atlassian provider added to plugin-auth-backend +- Updated user-settings with Atlassian connection From 044a4511eb1dd1c7dc646bb0dd6650c62d6bb812 Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:30:02 -0400 Subject: [PATCH 04/14] adds docs, fixes plugin Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- .changeset/swift-pugs-serve.md | 3 +- docs/auth/atlassian/provider.md | 64 +++++++++++++++++++ .../src/providers/atlassian/provider.ts | 4 +- 3 files changed, 67 insertions(+), 4 deletions(-) create mode 100644 docs/auth/atlassian/provider.md diff --git a/.changeset/swift-pugs-serve.md b/.changeset/swift-pugs-serve.md index e6f1945afb..8262a66d7f 100644 --- a/.changeset/swift-pugs-serve.md +++ b/.changeset/swift-pugs-serve.md @@ -1,12 +1,11 @@ --- -'example-app': patch '@backstage/core-app-api': patch '@backstage/core-plugin-api': patch '@backstage/plugin-auth-backend': patch '@backstage/plugin-user-settings': patch --- -Atlassian Cloud authentication +Atlassian auth provider - AtlassianAuth added to core-app-api - Atlassian provider added to plugin-auth-backend diff --git a/docs/auth/atlassian/provider.md b/docs/auth/atlassian/provider.md new file mode 100644 index 0000000000..38774ca3cc --- /dev/null +++ b/docs/auth/atlassian/provider.md @@ -0,0 +1,64 @@ +--- +id: provider +title: Atlassian Authentication Provider +sidebar_label: Atlassian +description: Adding Atlassian as an authentication provider in Backstage +--- + +The Backstage `core-plugin-api` package comes with an Atlassian authentication +provider that can authenticate users using Atlassian products. This auth +**only** provides scopes for the following APIs: + +- Confluence API +- User REST API +- Jira platform REST API +- Jira Service Desk API +- Personal data reporting API +- User identity API + +## Create an OAuth 2.0 (3LO) app in the Atlassian developer console + +To add Atlassian authentication, you must create an OAuth 2.0 (3LO) app. + +Go to `https://developer.atlassian.com/console/myapps/`. + +Click on the drop down `Create`, and choose `OAuth 2.0 integration`. + +Name your integration and click on the `Create` button. + +Settings for local development: + +- Callback URL: `http://localhost:7000/api/auth/atlassian` +- Use rotating refresh tokens +- For permissions, you **must** enable `View user profile` for the currently + logged-in user, under `User identity API` + +## Configuration + +The provider configuration can then be added to your `app-config.yaml` under the +root `auth` configuration: + +```yaml +auth: + environment: development + providers: + atlassian: + development: + clientId: ${AUTH_ATLASSIAN_CLIENT_ID} + clientSecret: ${AUTH_ATLASSIAN_CLIENT_SECRET} + scopes: ${AUTH_ATLASSIAN_SCOPES} +``` + +The Atlassian provider is a structure with three configuration keys: + +- `clientId`: The Key you generated in the developer console. +- `clientSecret`: The Secret tied to the generated Key. +- `scopes`: List of scopes the app has permissions for, separated by spaces. + +**NOTE:** the scopes `offline_access` and `read:me` are provided by default. + +## Adding the provider to the Backstage frontend + +To add the provider to the frontend, add the `atlassianAuthApi` reference and +`SignInPage` component as shown in +[Adding the provider to the sign-in page](../index.md#adding-the-provider-to-the-sign-in-page). diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts index c7d1a9590c..4c031cedc9 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.ts @@ -47,7 +47,7 @@ import { CatalogIdentityClient } from '../../lib/catalog'; import { Logger } from 'winston'; export type AtlassianAuthProviderOptions = OAuthProviderOptions & { - scopes: string[]; + scopes: string; signInResolver?: SignInResolver; authHandler: AuthHandler; tokenIssuer: TokenIssuer; @@ -253,7 +253,7 @@ export const createAtlassianProvider = ( const provider = new AtlassianAuthProvider({ clientId, clientSecret, - scopes: [scopes], + scopes, callbackUrl, authHandler, signInResolver, From 1f58e63bcc089788c9123f38ee144a909ecb610f Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Tue, 12 Oct 2021 11:35:31 -0400 Subject: [PATCH 05/14] updates test Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- plugins/auth-backend/src/providers/atlassian/provider.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/providers/atlassian/provider.test.ts b/plugins/auth-backend/src/providers/atlassian/provider.test.ts index 58c7468246..86ce21265e 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.test.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.test.ts @@ -54,7 +54,7 @@ describe('createAtlassianProvider', () => { clientId: 'mock', clientSecret: 'mock', callbackUrl: 'mock', - scopes: [], + scopes: 'scope', signInResolver: atlassianDefaultSignInResolver, }); From 93f6d19f7fd5db370294668f2cd86dc6fea0ae27 Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 13 Oct 2021 08:23:29 -0400 Subject: [PATCH 06/14] updates api reports Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- packages/core-app-api/api-report.md | 18 +++++++++++++++-- packages/core-plugin-api/api-report.md | 7 +++++++ plugins/auth-backend/api-report.md | 28 +++++++++++++++++++++++++- 3 files changed, 50 insertions(+), 3 deletions(-) diff --git a/packages/core-app-api/api-report.md b/packages/core-app-api/api-report.md index 22d5092aa6..869f9a6eb0 100644 --- a/packages/core-app-api/api-report.md +++ b/packages/core-app-api/api-report.md @@ -15,6 +15,7 @@ import { ApiRef } from '@backstage/core-plugin-api'; import { AppConfig } from '@backstage/config'; import { AppTheme } from '@backstage/core-plugin-api'; import { AppThemeApi } from '@backstage/core-plugin-api'; +import { atlassianAuthApiRef } from '@backstage/core-plugin-api'; import { auth0AuthApiRef } from '@backstage/core-plugin-api'; import { AuthProvider } from '@backstage/core-plugin-api'; import { AuthRequester } from '@backstage/core-plugin-api'; @@ -236,12 +237,25 @@ export class AppThemeSelector implements AppThemeApi { setActiveThemeId(themeId?: string): void; } +// Warning: (ae-missing-release-tag) "AtlassianAuth" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export class AtlassianAuth { + // Warning: (ae-forgotten-export) The symbol "OAuthApiCreateOptions" needs to be exported by the entry point index.d.ts + // + // (undocumented) + static create({ + discoveryApi, + environment, + provider, + oauthRequestApi, + }: OAuthApiCreateOptions): typeof atlassianAuthApiRef.T; +} + // Warning: (ae-missing-release-tag) "Auth0Auth" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) export class Auth0Auth { - // Warning: (ae-forgotten-export) The symbol "OAuthApiCreateOptions" needs to be exported by the entry point index.d.ts - // // (undocumented) static create({ discoveryApi, diff --git a/packages/core-plugin-api/api-report.md b/packages/core-plugin-api/api-report.md index 4d1fe4fffd..808131b026 100644 --- a/packages/core-plugin-api/api-report.md +++ b/packages/core-plugin-api/api-report.md @@ -211,6 +211,13 @@ export type AppThemeApi = { // @public (undocumented) export const appThemeApiRef: ApiRef; +// Warning: (ae-missing-release-tag) "atlassianAuthApiRef" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public +export const atlassianAuthApiRef: ApiRef< + OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionApi +>; + // Warning: (ae-missing-release-tag) "attachComponentData" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md index 0bdd73f3e8..ed0647ecda 100644 --- a/plugins/auth-backend/api-report.md +++ b/plugins/auth-backend/api-report.md @@ -16,6 +16,25 @@ import { PluginEndpointDiscovery } from '@backstage/backend-common'; import { Profile } from 'passport'; import { UserEntity } from '@backstage/catalog-model'; +// Warning: (ae-missing-release-tag) "AtlassianAuthProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export class AtlassianAuthProvider implements OAuthHandlers { + // Warning: (ae-forgotten-export) The symbol "AtlassianAuthProviderOptions" needs to be exported by the entry point index.d.ts + constructor(options: AtlassianAuthProviderOptions); + // (undocumented) + handler(req: express.Request): Promise<{ + response: OAuthResponse; + refreshToken: string; + }>; + // (undocumented) + refresh(req: OAuthRefreshRequest): Promise; + // Warning: (ae-forgotten-export) The symbol "RedirectInfo" needs to be exported by the entry point index.d.ts + // + // (undocumented) + start(req: OAuthStartRequest): Promise; +} + // Warning: (ae-missing-release-tag) "AuthProviderFactory" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) @@ -146,6 +165,14 @@ export const bitbucketUserIdSignInResolver: SignInResolver // @public (undocumented) export const bitbucketUsernameSignInResolver: SignInResolver; +// Warning: (ae-forgotten-export) The symbol "AtlassianProviderOptions" needs to be exported by the entry point index.d.ts +// Warning: (ae-missing-release-tag) "createAtlassianProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export const createAtlassianProvider: ( + options?: AtlassianProviderOptions | undefined, +) => AuthProviderFactory; + // Warning: (ae-missing-release-tag) "createAwsAlbProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) @@ -388,7 +415,6 @@ export interface OAuthHandlers { // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen // Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}' // Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen - // Warning: (ae-forgotten-export) The symbol "RedirectInfo" needs to be exported by the entry point index.d.ts start(req: OAuthStartRequest): Promise; } From 6c03f1b1378510b9de5d6f6a22fd318d1346c4b0 Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 13 Oct 2021 08:57:27 -0400 Subject: [PATCH 07/14] adds sidebar link Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- microsite/sidebars.json | 1 + 1 file changed, 1 insertion(+) diff --git a/microsite/sidebars.json b/microsite/sidebars.json index c269f8ac8f..541792eca6 100644 --- a/microsite/sidebars.json +++ b/microsite/sidebars.json @@ -214,6 +214,7 @@ "label": "Included providers", "ids": [ "auth/auth0/provider", + "auth/atlassian/provider", "auth/bitbucket/provider", "auth/microsoft/provider", "auth/github/provider", From ce038268c196af2b21c48ba73cc7ce7311f740fd Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 20 Oct 2021 17:15:00 -0400 Subject: [PATCH 08/14] feedback fixes Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- plugins/auth-backend/api-report.md | 15 +++++++++++--- .../src/providers/atlassian/index.ts | 5 ++++- .../src/providers/atlassian/provider.ts | 20 ++----------------- 3 files changed, 18 insertions(+), 22 deletions(-) diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md index ed0647ecda..dfccd2b5d6 100644 --- a/plugins/auth-backend/api-report.md +++ b/plugins/auth-backend/api-report.md @@ -35,6 +35,16 @@ export class AtlassianAuthProvider implements OAuthHandlers { start(req: OAuthStartRequest): Promise; } +// Warning: (ae-missing-release-tag) "AtlassianProviderOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) +// +// @public (undocumented) +export type AtlassianProviderOptions = { + authHandler?: AuthHandler; + signIn?: { + resolver: SignInResolver; + }; +}; + // Warning: (ae-missing-release-tag) "AuthProviderFactory" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) @@ -165,7 +175,6 @@ export const bitbucketUserIdSignInResolver: SignInResolver // @public (undocumented) export const bitbucketUsernameSignInResolver: SignInResolver; -// Warning: (ae-forgotten-export) The symbol "AtlassianProviderOptions" needs to be exported by the entry point index.d.ts // Warning: (ae-missing-release-tag) "createAtlassianProvider" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal) // // @public (undocumented) @@ -570,9 +579,9 @@ export type WebMessageResponse = // // src/identity/types.d.ts:25:5 - (ae-forgotten-export) The symbol "TokenParams" needs to be exported by the entry point index.d.ts // src/identity/types.d.ts:31:9 - (ae-forgotten-export) The symbol "AnyJWK" needs to be exported by the entry point index.d.ts -// src/providers/aws-alb/provider.d.ts:77:5 - (ae-forgotten-export) The symbol "AuthHandler" needs to be exported by the entry point index.d.ts +// src/providers/atlassian/provider.d.ts:38:5 - (ae-forgotten-export) The symbol "AuthHandler" needs to be exported by the entry point index.d.ts +// src/providers/atlassian/provider.d.ts:43:9 - (ae-forgotten-export) The symbol "SignInResolver" needs to be exported by the entry point index.d.ts // src/providers/aws-alb/provider.d.ts:77:5 - (ae-forgotten-export) The symbol "AwsAlbResult" needs to be exported by the entry point index.d.ts -// src/providers/aws-alb/provider.d.ts:85:9 - (ae-forgotten-export) The symbol "SignInResolver" needs to be exported by the entry point index.d.ts // src/providers/types.d.ts:99:5 - (ae-forgotten-export) The symbol "AuthProviderConfig" needs to be exported by the entry point index.d.ts // src/providers/types.d.ts:121:8 - (tsdoc-missing-deprecation-message) The @deprecated block must include a deprecation message, e.g. describing the recommended alternative ``` diff --git a/plugins/auth-backend/src/providers/atlassian/index.ts b/plugins/auth-backend/src/providers/atlassian/index.ts index b99b63d7bc..cf3eb901d9 100644 --- a/plugins/auth-backend/src/providers/atlassian/index.ts +++ b/plugins/auth-backend/src/providers/atlassian/index.ts @@ -15,4 +15,7 @@ */ export { createAtlassianProvider } from './provider'; -export type { AtlassianAuthProvider } from './provider'; +export type { + AtlassianAuthProvider, + AtlassianProviderOptions, +} from './provider'; diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts index 4c031cedc9..f9b4b07715 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.ts @@ -204,14 +204,8 @@ export type AtlassianProviderOptions = { /** * Configure sign-in for this provider, without it the provider can not be used to sign users in. */ - /** - * Maps an auth result to a Backstage identity for the user. - * - * Set to `'email'` to use the default email-based sign in resolver, which will search - * the catalog for a single user entity that has a matching `microsoft.com/email` annotation. - */ signIn?: { - resolver?: SignInResolver; + resolver: SignInResolver; }; }; @@ -240,23 +234,13 @@ export const createAtlassianProvider = ( const authHandler: AuthHandler = options?.authHandler ?? atlassianDefaultAuthHandler; - const signInResolverFn = - options?.signIn?.resolver ?? atlassianDefaultSignInResolver; - - const signInResolver: SignInResolver = info => - signInResolverFn(info, { - catalogIdentityClient, - tokenIssuer, - logger, - }); - const provider = new AtlassianAuthProvider({ clientId, clientSecret, scopes, callbackUrl, authHandler, - signInResolver, + signInResolver: options?.signIn?.resolver, catalogIdentityClient, logger, tokenIssuer, From 6e4ae4de40beca2c98e1dc7b53098e0fdff3bfbb Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 20 Oct 2021 17:20:32 -0400 Subject: [PATCH 09/14] fix ADOPTERS Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- ADOPTERS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/ADOPTERS.md b/ADOPTERS.md index 9c1f1e046b..f96cc08e18 100644 --- a/ADOPTERS.md +++ b/ADOPTERS.md @@ -57,3 +57,4 @@ | [Gelato](https://gelato.com/) | [Dmitry Makarenko](https://github.com/dmitry-makarenko-gelato) | Developer portal: documentation, service templates, org structure, service catalog, plugins for integration with internal and third-party systems🚀. | | [GoCardless](https://gocardless.com/) | [James Turley](https://github.com/tragiclifestories) | Developer portal: documentation, service templates, org structure, service catalog, plugins for integration with internal systems. | | [Box](https://www.box.com) | [@kielosz](https://github.com/kielosz), [@jluk-box](https://github.com/jluk-box), [@ptychu](https://github.com/ptychu), [@alexrybch](https://github.com/alexrybch), [@szubster](https://github.com/szubster) | Developer portal for service catalog, integration with internal systems, new service onboarding. | +| [Bazaarvoice](https://www.bazaarvoice.com) | [@niallmccullagh](https://github.com/niallmccullagh) | Developer portal for service catalog and scaffolds, publishing Github docs and API documentation, visualising our internal tech radar and our product engineering org structure. | From deda608b2eeb55c755e13eda7d7b030dc0a24e9e Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 20 Oct 2021 20:53:54 -0400 Subject: [PATCH 10/14] removes default signin resolver, updates tests Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- .../src/providers/atlassian/provider.test.ts | 12 +----------- .../src/providers/atlassian/provider.ts | 17 ----------------- 2 files changed, 1 insertion(+), 28 deletions(-) diff --git a/plugins/auth-backend/src/providers/atlassian/provider.test.ts b/plugins/auth-backend/src/providers/atlassian/provider.test.ts index 86ce21265e..7bed582f81 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.test.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.test.ts @@ -14,10 +14,7 @@ * limitations under the License. */ -import { - AtlassianAuthProvider, - atlassianDefaultSignInResolver, -} from './provider'; +import { AtlassianAuthProvider } from './provider'; import * as helpers from '../../lib/passport/PassportStrategyHelper'; import { getVoidLogger } from '@backstage/backend-common'; import { TokenIssuer } from '../../identity'; @@ -55,7 +52,6 @@ describe('createAtlassianProvider', () => { clientSecret: 'mock', callbackUrl: 'mock', scopes: 'scope', - signInResolver: atlassianDefaultSignInResolver, }); it('should auth', async () => { @@ -84,9 +80,6 @@ describe('createAtlassianProvider', () => { }); const { response } = await provider.handler({} as any); expect(response).toEqual({ - backstageIdentity: { - id: 'conrad', - }, providerInfo: { accessToken: 'accessToken', expiresInSeconds: 123, @@ -137,9 +130,6 @@ describe('createAtlassianProvider', () => { const response = await provider.refresh({} as any); expect(response).toEqual({ - backstageIdentity: { - id: 'mockuser', - }, profile: { displayName: 'Mocked User', email: 'mockuser@gmail.com', diff --git a/plugins/auth-backend/src/providers/atlassian/provider.ts b/plugins/auth-backend/src/providers/atlassian/provider.ts index f9b4b07715..e19f29a3a4 100644 --- a/plugins/auth-backend/src/providers/atlassian/provider.ts +++ b/plugins/auth-backend/src/providers/atlassian/provider.ts @@ -55,23 +55,6 @@ export type AtlassianAuthProviderOptions = OAuthProviderOptions & { logger: Logger; }; -export const atlassianDefaultSignInResolver: SignInResolver = - async (info, ctx) => { - const { profile, result } = info; - - let id = result.fullProfile.id; - - if (profile.email) { - id = profile.email.split('@')[0]; - } - - const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: id, ent: [`user:default/${id}`] }, - }); - - return { id, token }; - }; - export const atlassianDefaultAuthHandler: AuthHandler = async ({ fullProfile, params, From b72364d9eecc6293b93584facfc72eadd253e17b Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 20 Oct 2021 21:09:37 -0400 Subject: [PATCH 11/14] remove signin from identity providers Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- packages/app/src/identityProviders.ts | 7 ------- 1 file changed, 7 deletions(-) diff --git a/packages/app/src/identityProviders.ts b/packages/app/src/identityProviders.ts index 70630a3d0a..49204d2b5e 100644 --- a/packages/app/src/identityProviders.ts +++ b/packages/app/src/identityProviders.ts @@ -25,7 +25,6 @@ import { oauth2ApiRef, oidcAuthApiRef, bitbucketAuthApiRef, - atlassianAuthApiRef, } from '@backstage/core-plugin-api'; export const providers = [ @@ -89,10 +88,4 @@ export const providers = [ message: 'Sign In using Bitbucket', apiRef: bitbucketAuthApiRef, }, - { - id: 'atlassian-auth-provider', - title: 'Atlassian', - message: 'Sign In using Atlassian', - apiRef: atlassianAuthApiRef, - }, ]; From b851a640027fb1e1385171ee7a836693fd9ed65a Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 20 Oct 2021 21:11:29 -0400 Subject: [PATCH 12/14] attempting to fix adopters Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- ADOPTERS.md | 1 - 1 file changed, 1 deletion(-) diff --git a/ADOPTERS.md b/ADOPTERS.md index f96cc08e18..9c1f1e046b 100644 --- a/ADOPTERS.md +++ b/ADOPTERS.md @@ -57,4 +57,3 @@ | [Gelato](https://gelato.com/) | [Dmitry Makarenko](https://github.com/dmitry-makarenko-gelato) | Developer portal: documentation, service templates, org structure, service catalog, plugins for integration with internal and third-party systems🚀. | | [GoCardless](https://gocardless.com/) | [James Turley](https://github.com/tragiclifestories) | Developer portal: documentation, service templates, org structure, service catalog, plugins for integration with internal systems. | | [Box](https://www.box.com) | [@kielosz](https://github.com/kielosz), [@jluk-box](https://github.com/jluk-box), [@ptychu](https://github.com/ptychu), [@alexrybch](https://github.com/alexrybch), [@szubster](https://github.com/szubster) | Developer portal for service catalog, integration with internal systems, new service onboarding. | -| [Bazaarvoice](https://www.bazaarvoice.com) | [@niallmccullagh](https://github.com/niallmccullagh) | Developer portal for service catalog and scaffolds, publishing Github docs and API documentation, visualising our internal tech radar and our product engineering org structure. | From 32cd8e740d7c44e7d342762bfe7c98c3a40496f5 Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Wed, 20 Oct 2021 21:17:29 -0400 Subject: [PATCH 13/14] attempting to restore adopters Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- ADOPTERS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/ADOPTERS.md b/ADOPTERS.md index 9c1f1e046b..f96cc08e18 100644 --- a/ADOPTERS.md +++ b/ADOPTERS.md @@ -57,3 +57,4 @@ | [Gelato](https://gelato.com/) | [Dmitry Makarenko](https://github.com/dmitry-makarenko-gelato) | Developer portal: documentation, service templates, org structure, service catalog, plugins for integration with internal and third-party systems🚀. | | [GoCardless](https://gocardless.com/) | [James Turley](https://github.com/tragiclifestories) | Developer portal: documentation, service templates, org structure, service catalog, plugins for integration with internal systems. | | [Box](https://www.box.com) | [@kielosz](https://github.com/kielosz), [@jluk-box](https://github.com/jluk-box), [@ptychu](https://github.com/ptychu), [@alexrybch](https://github.com/alexrybch), [@szubster](https://github.com/szubster) | Developer portal for service catalog, integration with internal systems, new service onboarding. | +| [Bazaarvoice](https://www.bazaarvoice.com) | [@niallmccullagh](https://github.com/niallmccullagh) | Developer portal for service catalog and scaffolds, publishing Github docs and API documentation, visualising our internal tech radar and our product engineering org structure. | From 727554274e2b038be822c948b6d1aedf9156d3e8 Mon Sep 17 00:00:00 2001 From: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> Date: Thu, 21 Oct 2021 07:22:09 -0400 Subject: [PATCH 14/14] updated api report, adds Atlassian to vocab Signed-off-by: Daniel Deloff <44780793+rv-ddeloff@users.noreply.github.com> --- .github/styles/vocab.txt | 1 + plugins/auth-backend/api-report.md | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/styles/vocab.txt b/.github/styles/vocab.txt index a38baab3dc..eea86a6097 100644 --- a/.github/styles/vocab.txt +++ b/.github/styles/vocab.txt @@ -8,6 +8,7 @@ apis args asciidoc async +Atlassian automations autoscaling Autoscaling diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md index dfccd2b5d6..572f182082 100644 --- a/plugins/auth-backend/api-report.md +++ b/plugins/auth-backend/api-report.md @@ -579,8 +579,8 @@ export type WebMessageResponse = // // src/identity/types.d.ts:25:5 - (ae-forgotten-export) The symbol "TokenParams" needs to be exported by the entry point index.d.ts // src/identity/types.d.ts:31:9 - (ae-forgotten-export) The symbol "AnyJWK" needs to be exported by the entry point index.d.ts -// src/providers/atlassian/provider.d.ts:38:5 - (ae-forgotten-export) The symbol "AuthHandler" needs to be exported by the entry point index.d.ts -// src/providers/atlassian/provider.d.ts:43:9 - (ae-forgotten-export) The symbol "SignInResolver" needs to be exported by the entry point index.d.ts +// src/providers/atlassian/provider.d.ts:37:5 - (ae-forgotten-export) The symbol "AuthHandler" needs to be exported by the entry point index.d.ts +// src/providers/atlassian/provider.d.ts:42:9 - (ae-forgotten-export) The symbol "SignInResolver" needs to be exported by the entry point index.d.ts // src/providers/aws-alb/provider.d.ts:77:5 - (ae-forgotten-export) The symbol "AwsAlbResult" needs to be exported by the entry point index.d.ts // src/providers/types.d.ts:99:5 - (ae-forgotten-export) The symbol "AuthProviderConfig" needs to be exported by the entry point index.d.ts // src/providers/types.d.ts:121:8 - (tsdoc-missing-deprecation-message) The @deprecated block must include a deprecation message, e.g. describing the recommended alternative