From d4a8246fd1799d95c4d2b2a25b75c0caf5a5e56f Mon Sep 17 00:00:00 2001 From: Tyler Davis Date: Sat, 11 Jan 2025 00:01:57 +1100 Subject: [PATCH 1/4] cfaccess: fallback to identity email when constructing the user profile Signed-off-by: Tyler Davis --- .changeset/fast-seas-hunt.md | 5 ++++ .../src/authenticator.test.ts | 23 ++++++++++++++++++- .../src/authenticator.ts | 2 +- 3 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 .changeset/fast-seas-hunt.md diff --git a/.changeset/fast-seas-hunt.md b/.changeset/fast-seas-hunt.md new file mode 100644 index 0000000000..6e187cb6b1 --- /dev/null +++ b/.changeset/fast-seas-hunt.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch +--- + +Fallback to email from cfIdentity when constructing user profile for Service Token support. diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts index 678e513412..69fcb742e5 100644 --- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts +++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts @@ -18,7 +18,7 @@ import { mockServices } from '@backstage/backend-test-utils'; import { createCloudflareAccessAuthenticator } from './authenticator'; describe('authenticator', () => { - it('createCloudflareAccessAuthenticator works', async () => { + it('works for normal users', async () => { const auth = createCloudflareAccessAuthenticator({ cache: mockServices.cache.mock(), }); @@ -38,4 +38,25 @@ describe('authenticator', () => { }, }); }); + + it('works for service tokens', async () => { + const auth = createCloudflareAccessAuthenticator({ + cache: mockServices.cache.mock(), + }); + + const profile = await auth.defaultProfileTransform( + { + cfIdentity: { name: 'Name', email: 'hello@example.com' } as any, + claims: {} as any, + token: 'fake', + }, + {} as any, + ); + expect(profile).toEqual({ + profile: { + displayName: 'Name', + email: 'hello@example.com', + }, + }); + }); }); diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts index c15a1a19a0..632c439d7e 100644 --- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts @@ -38,7 +38,7 @@ export function createCloudflareAccessAuthenticator(options?: { async defaultProfileTransform(result: CloudflareAccessResult) { return { profile: { - email: result.claims.email, + email: result.claims.email ?? result.cfIdentity.email, displayName: result.cfIdentity.name, }, }; From 96a6c36bb4e118da5a01319146072f18cbe00d55 Mon Sep 17 00:00:00 2001 From: Tyler Davis Date: Sat, 11 Jan 2025 08:06:39 +1100 Subject: [PATCH 2/4] simplify to always use email from cfIdentity Signed-off-by: Tyler Davis --- .../src/authenticator.test.ts | 2 +- .../src/authenticator.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts index 69fcb742e5..ea38bd5180 100644 --- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts +++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.test.ts @@ -25,7 +25,7 @@ describe('authenticator', () => { const profile = await auth.defaultProfileTransform( { - cfIdentity: { name: 'Name' } as any, + cfIdentity: { name: 'Name', email: 'hello@example.com' } as any, claims: { email: 'hello@example.com' } as any, token: 'fake', }, diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts index 632c439d7e..7b311a60f0 100644 --- a/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-cloudflare-access-provider/src/authenticator.ts @@ -38,7 +38,7 @@ export function createCloudflareAccessAuthenticator(options?: { async defaultProfileTransform(result: CloudflareAccessResult) { return { profile: { - email: result.claims.email ?? result.cfIdentity.email, + email: result.cfIdentity.email, displayName: result.cfIdentity.name, }, }; From 197dda1483fc0beab9a95c24c4534e98c63a5db1 Mon Sep 17 00:00:00 2001 From: Tyler Davis Date: Sat, 11 Jan 2025 08:08:00 +1100 Subject: [PATCH 3/4] update changeset Signed-off-by: Tyler Davis --- .changeset/fast-seas-hunt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/fast-seas-hunt.md b/.changeset/fast-seas-hunt.md index 6e187cb6b1..c4fb45dd47 100644 --- a/.changeset/fast-seas-hunt.md +++ b/.changeset/fast-seas-hunt.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch --- -Fallback to email from cfIdentity when constructing user profile for Service Token support. +Use email from cfIdentity instead of claims when constructing user profile for Service Token support. From 486fe1ce689fe2146974c99af5b466c62cb6c320 Mon Sep 17 00:00:00 2001 From: Tyler Davis Date: Tue, 14 Jan 2025 09:05:32 +1100 Subject: [PATCH 4/4] changeset grammar Signed-off-by: Tyler Davis --- .changeset/fast-seas-hunt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/fast-seas-hunt.md b/.changeset/fast-seas-hunt.md index c4fb45dd47..0dcf8daf30 100644 --- a/.changeset/fast-seas-hunt.md +++ b/.changeset/fast-seas-hunt.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch --- -Use email from cfIdentity instead of claims when constructing user profile for Service Token support. +Use the email from `cfIdentity` instead of `claims` when constructing user profile in order to support Cloudflare Service Tokens.