From 19a0d5b4295e8012851dd86800cd521746400dc7 Mon Sep 17 00:00:00 2001
From: Aramis Sennyey <sennyeya@amazon.com>
Date: Mon, 6 Mar 2023 17:03:42 -0500
Subject: [PATCH 1/3] Add additional auth backend props and limit visibility.

Signed-off-by: Aramis Sennyey <sennyeya@amazon.com>
---
 plugins/auth-backend/config.d.ts | 97 +++++++++++++++++++++++++++++---
 1 file changed, 88 insertions(+), 9 deletions(-)

diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts
index 5aff9df90a..cdd3fe1bf0 100644
--- a/plugins/auth-backend/config.d.ts
+++ b/plugins/auth-backend/config.d.ts
@@ -62,30 +62,72 @@ export interface Config {
      */
     providers?: {
       google?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          callbackUrl: string;
+        };
       };
       github?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          callbackUrl?: string;
+          enterpriseInstanceUrl?: string;
+        };
       };
       gitlab?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          audience?: string;
+          callbackUrl?: string;
+        };
       };
       saml?: {
         entryPoint: string;
         logoutUrl?: string;
         issuer: string;
+        /**
+         * @visibility secret
+         */
         cert: string;
         audience?: string;
+        /**
+         * @visibility secret
+         */
         privateKey?: string;
         authnContext?: string[];
         identifierFormat?: string;
+        /**
+         * @visibility secret
+         */
         decryptionPvk?: string;
         signatureAlgorithm?: 'sha256' | 'sha512';
         digestAlgorithm?: string;
         acceptedClockSkewMs?: number;
       };
       okta?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          audience: string;
+          authServerId?: string;
+          idp?: string;
+          callbackUrl?: string;
+        };
       };
       oauth2?: {
         [authEnv: string]: {
@@ -101,19 +143,56 @@ export interface Config {
         };
       };
       oidc?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          callbackUrl?: string;
+          metadataUrl: string;
+          scope?: string;
+          prompt?: string;
+        };
       };
       auth0?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          domain: string;
+          callbackUrl?: string;
+          audience?: string;
+          connection?: string;
+          connectionScope?: string;
+        };
       };
       microsoft?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          tenantId: string;
+          callbackUrl?: string;
+        };
       };
       onelogin?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          issuer: string;
+          callbackUrl?: string;
+        };
       };
       awsalb?: {
-        issuer?: string;
+        iss?: string;
         region: string;
       };
       cfaccess?: {

From d8f774c30dfac5c24ad317740fedb0173e9470e6 Mon Sep 17 00:00:00 2001
From: Aramis Sennyey <sennyeya@amazon.com>
Date: Thu, 16 Mar 2023 11:16:28 -0400
Subject: [PATCH 2/3] Add changeset.

Signed-off-by: Aramis Sennyey <sennyeya@amazon.com>
---
 .changeset/khaki-cars-drum.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/khaki-cars-drum.md

diff --git a/.changeset/khaki-cars-drum.md b/.changeset/khaki-cars-drum.md
new file mode 100644
index 0000000000..325b0f8ba5
--- /dev/null
+++ b/.changeset/khaki-cars-drum.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Enforce the secret visibility of certificates and client secrets in the auth backend. Also, document all known options for each auth plugin.

From 0b5febcd753f5bc62924ef60de20032ce7d90923 Mon Sep 17 00:00:00 2001
From: Aramis Sennyey <sennyeya@amazon.com>
Date: Thu, 16 Mar 2023 17:36:39 -0400
Subject: [PATCH 3/3] Make callbackUrl optional.

Signed-off-by: Aramis Sennyey <sennyeya@amazon.com>
---
 plugins/auth-backend/config.d.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts
index cdd3fe1bf0..8d76ca8bf5 100644
--- a/plugins/auth-backend/config.d.ts
+++ b/plugins/auth-backend/config.d.ts
@@ -68,7 +68,7 @@ export interface Config {
            * @visibility secret
            */
           clientSecret: string;
-          callbackUrl: string;
+          callbackUrl?: string;
         };
       };
       github?: {