Merge pull request #13920 from imleozzito/master

feat: allow auth0 provider to specify connection/connection_scope config

.changeset/pretty-buttons-develop.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Auth0 provider now supports optional `connection` and `connectionScope` parameters to configure social identity providers.

docs/auth/auth0/provider.md

@@ -35,6 +35,8 @@ auth:
         clientSecret: ${AUTH_AUTH0_CLIENT_SECRET}
         domain: ${AUTH_AUTH0_DOMAIN_ID}
         audience: ${AUTH_AUTH0_AUDIENCE}
+        connection: ${AUTH_AUTH0_CONNECTION}
+        connectionScope: ${AUTH_AUTH0_CONNECTION_SCOPE}
 ```
 
 The Auth0 provider is a structure with three configuration keys:
@@ -44,6 +46,12 @@ The Auth0 provider is a structure with three configuration keys:
   page
 - `domain`: The Application domain, found on the Auth0 Application page
 
+## Optional Configuration
+
+- `audience`: The intended recipients of the token
+- `connection`: Social identity provider name. To check the available social connections, please visit [Auth0 Social Connections](https://marketplace.auth0.com/features/social-connections).
+- `connectionScope`: Additional scopes in the interactive token request. It should always be used in combination with the `connection` parameter
+
 ## Adding the provider to the Backstage frontend
 
 To add the provider to the frontend, add the `auth0AuthApi` reference and

plugins/auth-backend/src/providers/auth0/provider.ts

@@ -55,6 +55,8 @@ export type Auth0AuthProviderOptions = OAuthProviderOptions & {
   authHandler: AuthHandler<OAuthResult>;
   resolverContext: AuthResolverContext;
   audience?: string;
+  connection?: string;
+  connectionScope?: string;
 };
 
 export class Auth0AuthProvider implements OAuthHandlers {
@@ -63,6 +65,8 @@ export class Auth0AuthProvider implements OAuthHandlers {
   private readonly authHandler: AuthHandler<OAuthResult>;
   private readonly resolverContext: AuthResolverContext;
   private readonly audience?: string;
+  private readonly connection?: string;
+  private readonly connectionScope?: string;
 
   /**
    * Due to passport-auth0 forcing options.state = true,
@@ -86,6 +90,8 @@ export class Auth0AuthProvider implements OAuthHandlers {
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
     this.audience = options.audience;
+    this.connection = options.connection;
+    this.connectionScope = options.connectionScope;
     this._strategy = new Auth0Strategy(
       {
         clientID: options.clientId,
@@ -127,6 +133,10 @@ export class Auth0AuthProvider implements OAuthHandlers {
       scope: req.scope,
       state: encodeState(req.state),
       ...(this.audience ? { audience: this.audience } : {}),
+      ...(this.connection ? { connection: this.connection } : {}),
+      ...(this.connectionScope
+        ? { connection_scope: this.connectionScope }
+        : {}),
     });
   }
 
@@ -136,6 +146,10 @@ export class Auth0AuthProvider implements OAuthHandlers {
       PrivateInfo
     >(req, this._strategy, {
       ...(this.audience ? { audience: this.audience } : {}),
+      ...(this.connection ? { connection: this.connection } : {}),
+      ...(this.connectionScope
+        ? { connection_scope: this.connectionScope }
+        : {}),
     });
 
     return {
@@ -224,6 +238,8 @@ export const auth0 = createAuthProviderIntegration({
         const domain = envConfig.getString('domain');
         const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
         const audience = envConfig.getOptionalString('audience');
+        const connection = envConfig.getOptionalString('connection');
+        const connectionScope = envConfig.getOptionalString('connectionScope');
         const callbackUrl =
           customCallbackUrl ||
           `${globalConfig.baseUrl}/${providerId}/handler/frame`;
@@ -245,6 +261,8 @@ export const auth0 = createAuthProviderIntegration({
           signInResolver,
           resolverContext,
           audience,
+          connection,
+          connectionScope,
         });
 
         return OAuthAdapter.fromConfig(globalConfig, provider, {