From c3a91f821390e1bfb3a2d1c0f2f37d0e3cac891b Mon Sep 17 00:00:00 2001 From: Aramis Date: Fri, 26 Jan 2024 17:13:59 -0500 Subject: [PATCH 1/6] fix(auth): add support for additional alg values Signed-off-by: Aramis --- plugins/auth-backend/src/identity/router.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/identity/router.ts b/plugins/auth-backend/src/identity/router.ts index d994f44d37..38e48f0a5d 100644 --- a/plugins/auth-backend/src/identity/router.ts +++ b/plugins/auth-backend/src/identity/router.ts @@ -34,7 +34,7 @@ export function createOidcRouter(options: Options) { jwks_uri: `${baseUrl}/.well-known/jwks.json`, response_types_supported: ['id_token'], subject_types_supported: ['public'], - id_token_signing_alg_values_supported: ['RS256'], + id_token_signing_alg_values_supported: ['RS256', 'ES256'], scopes_supported: ['openid'], token_endpoint_auth_methods_supported: [], claims_supported: ['sub'], From f6dfb17b786fc5cedd9db14f249e82f56828b767 Mon Sep 17 00:00:00 2001 From: Aramis Date: Fri, 26 Jan 2024 17:21:27 -0500 Subject: [PATCH 2/6] add additional scopes Signed-off-by: Aramis --- plugins/auth-backend/src/identity/router.ts | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/identity/router.ts b/plugins/auth-backend/src/identity/router.ts index 38e48f0a5d..c9ae9e685a 100644 --- a/plugins/auth-backend/src/identity/router.ts +++ b/plugins/auth-backend/src/identity/router.ts @@ -34,7 +34,18 @@ export function createOidcRouter(options: Options) { jwks_uri: `${baseUrl}/.well-known/jwks.json`, response_types_supported: ['id_token'], subject_types_supported: ['public'], - id_token_signing_alg_values_supported: ['RS256', 'ES256'], + id_token_signing_alg_values_supported: [ + 'RS256', + 'RS384', + 'RS512', + 'ES256', + 'ES384', + 'ES512', + 'PS256', + 'PS384', + 'PS512', + 'EdDSA', + ], scopes_supported: ['openid'], token_endpoint_auth_methods_supported: [], claims_supported: ['sub'], From 97f8724e91c69aabf3f36f28bc6866ca919c7b8b Mon Sep 17 00:00:00 2001 From: Aramis Date: Fri, 26 Jan 2024 17:25:23 -0500 Subject: [PATCH 3/6] add changeset Signed-off-by: Aramis --- .changeset/dirty-cheetahs-shave.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/dirty-cheetahs-shave.md diff --git a/.changeset/dirty-cheetahs-shave.md b/.changeset/dirty-cheetahs-shave.md new file mode 100644 index 0000000000..8f9a476a25 --- /dev/null +++ b/.changeset/dirty-cheetahs-shave.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': minor +--- + +Support additional algorithms in the `/.well-known/openid-configuration` endpoint. From 4a89bc48b16d58d9a030c3e7151d86bffa1d785d Mon Sep 17 00:00:00 2001 From: Aramis Date: Sat, 27 Jan 2024 00:47:01 -0500 Subject: [PATCH 4/6] add support for service-to-service auth external callers Signed-off-by: Aramis --- plugins/auth-backend/src/identity/router.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/plugins/auth-backend/src/identity/router.ts b/plugins/auth-backend/src/identity/router.ts index c9ae9e685a..422b7907c0 100644 --- a/plugins/auth-backend/src/identity/router.ts +++ b/plugins/auth-backend/src/identity/router.ts @@ -44,6 +44,9 @@ export function createOidcRouter(options: Options) { 'PS256', 'PS384', 'PS512', + 'HS256', + 'HS384', + 'HS512', 'EdDSA', ], scopes_supported: ['openid'], From ee3cbed39d889ba7661a9f1526611c260489cd6d Mon Sep 17 00:00:00 2001 From: Aramis Date: Tue, 30 Jan 2024 22:47:16 -0500 Subject: [PATCH 5/6] remove symmetric keys Signed-off-by: Aramis --- plugins/auth-backend/src/identity/router.ts | 3 --- 1 file changed, 3 deletions(-) diff --git a/plugins/auth-backend/src/identity/router.ts b/plugins/auth-backend/src/identity/router.ts index 422b7907c0..c9ae9e685a 100644 --- a/plugins/auth-backend/src/identity/router.ts +++ b/plugins/auth-backend/src/identity/router.ts @@ -44,9 +44,6 @@ export function createOidcRouter(options: Options) { 'PS256', 'PS384', 'PS512', - 'HS256', - 'HS384', - 'HS512', 'EdDSA', ], scopes_supported: ['openid'], From 903ea055d58e4ea29ca5b442c60247d90c92562d Mon Sep 17 00:00:00 2001 From: Aramis Date: Tue, 30 Jan 2024 22:47:24 -0500 Subject: [PATCH 6/6] update changeset Signed-off-by: Aramis --- .changeset/dirty-cheetahs-shave.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/dirty-cheetahs-shave.md b/.changeset/dirty-cheetahs-shave.md index 8f9a476a25..1691adec2d 100644 --- a/.changeset/dirty-cheetahs-shave.md +++ b/.changeset/dirty-cheetahs-shave.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-auth-backend': minor +'@backstage/plugin-auth-backend': patch --- Support additional algorithms in the `/.well-known/openid-configuration` endpoint.