paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Merge pull request #23909 from yaegashi/new-azure-easyauth

Browse Source 
Add auth-backend-module-azure-easyauth-provider
This commit is contained in:
Patrik Oldsberg
2024-04-16 12:33:32 +02:00
committed by GitHub
parent 10f6e2698d a9d1b56ab7
commit c786f06e4e
21 changed files with 639 additions and 493 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/fifty-pumpkins-begin.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend': patch
---
Refactored the `azure-easyauth` provider to use the implementation from `@backstage/plugin-auth-backend-module-azure-easyauth-provider`.
.changeset/wild-rockets-tell.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend-module-azure-easyauth-provider': minor
---
New auth backend module to add `azure-easyauth` provider. Note that as part of this change the default provider ID has been changed from `easyAuth` to `azureEasyAuth`, which means that if you switch to this new module you need to update your app config as well as the `provider` prop of the `ProxiedSignInPage` in the frontend.
docs/auth/microsoft/azure-easyauth.md
+33 -43
View File
@@ -7,62 +7,52 @@ description: Adding Azure's EasyAuth Proxy as an authentication provider in Back
The Backstage `core-plugin-api` package comes with a Microsoft authentication provider that can authenticate users using Microsoft Entra ID (formerly Azure Active Directory) for PaaS service hosted in Azure that support Easy Auth, such as Azure App Services.
## Backstage Changes
## Backend Changes
Add the following into your `app-config.yaml` or `app-config.production.yaml` file
Add the following into your `app-config.yaml` under the root `auth` configuration:
```yaml
```yaml title="app-config.yaml"
auth:
environment: development
providers:
azure-easyauth: {}
azureEasyAuth:
signIn:
resolvers:
- resolver: idMatchingUserEntityAnnotation
- resolver: emailMatchingUserEntityProfileEmail
- resolver: emailLocalPartMatchingUserEntityName
```
Add a `providerFactories` entry to the router in
`packages/backend/src/plugins/auth.ts`.
The `idMatchingUserEntityAnnotation` is
[a builtin sign-in resolver](../identity-resolver.md#using-builtin-resolvers) from `azureEasyAuth` provider.
It tries to find a user entity with [a `graph.microsoft.com/user-id` annotation](../../features/software-catalog/well-known-annotations.md#graphmicrosoftcomtenant-id-graphmicrosoftcomgroup-id-graphmicrosoftcomuser-id)
which matches the object ID of the user attempting to sign in.
If you want to provide your own sign-in resolver,
see [Building Custom Resolvers](../identity-resolver.md#building-custom-resolvers).
```ts
import { providers } from '@backstage/plugin-auth-backend';
Add the `@backstage/plugin-auth-backend-module-azure-easyauth-provider` to your backend installation.
export default async function createPlugin(
env: PluginEnvironment,
): Promise<Router> {
const authProviderFactories = {
'azure-easyauth': providers.easyAuth.create({
signIn: {
resolver: async (info, ctx) => {
const {
fullProfile: { id },
} = info.result;
```sh
# From your Backstage root directory
yarn --cwd packages/backend add @backstage/plugin-auth-backend-module-azure-easyauth-provider
```
if (!id) {
throw new Error('User profile contained no id');
}
Then, add it to your backend's source,
return await ctx.signInWithCatalogUser({
annotations: {
'graph.microsoft.com/user-id': id,
},
});
},
},
}),
};
```ts title="packages/backend/src/index.ts"
const backend = createBackend();
return await createRouter({
logger: env.logger,
config: env.config,
database: env.database,
discovery: env.discovery,
tokenManager: env.tokenManager,
providerFactories: authProviderFactories,
});
}
backend.add(import('@backstage/plugin-auth-backend'));
// highlight-add-next-line
backend.add(
import('@backstage/plugin-auth-backend-module-azure-easyauth-provider'),
);
await backend.start();
```
Now the backend is ready to serve auth requests on the
`/api/auth/azure-easyauth/refresh` endpoint. All that's left is to update the frontend
sign-in mechanism to poll that endpoint through the IAP, on the user's behalf.
`/api/auth/azureEasyAuth/refresh` endpoint. All that's left is to update the frontend
sign-in mechanism to poll that endpoint through the Easy Auth proxy, on the user's behalf.
## Frontend Changes
@@ -81,7 +71,7 @@ const app = createApp({
SignInPage: props => {
const configApi = useApi(configApiRef);
if (configApi.getString('auth.environment') !== 'development') {
return <ProxiedSignInPage {...props} provider="azure-easyauth" />;
return <ProxiedSignInPage {...props} provider="azureEasyAuth" />;
}
return (
<SignInPage
plugins/auth-backend-module-azure-easyauth-provider/.eslintrc.js
+1
View File
@@ -0,0 +1 @@
module.exports = require('@backstage/cli/config/eslint-factory')(__dirname);
plugins/auth-backend-module-azure-easyauth-provider/README.md
+5
View File
@@ -0,0 +1,5 @@
# Auth Backend Module - Azure Easy Auth Provider
## Links
- [The Backstage homepage](https://backstage.io)
plugins/auth-backend-module-azure-easyauth-provider/api-report.md
+40
View File
@@ -0,0 +1,40 @@
## API Report File for "@backstage/plugin-auth-backend-module-azure-easyauth-provider"
> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
```ts
import { BackendFeature } from '@backstage/backend-plugin-api';
import { Profile } from 'passport';
import { ProxyAuthenticator } from '@backstage/plugin-auth-node';
import { SignInResolverFactory } from '@backstage/plugin-auth-node';
// @public (undocumented)
const authModuleAzureEasyAuthProvider: () => BackendFeature;
export default authModuleAzureEasyAuthProvider;
// @public (undocumented)
export const azureEasyAuthAuthenticator: ProxyAuthenticator<
void,
AzureEasyAuthResult,
{
accessToken: string | undefined;
}
>;
// @public (undocumented)
export type AzureEasyAuthResult = {
fullProfile: Profile;
accessToken?: string;
};
// @public (undocumented)
export namespace azureEasyAuthSignInResolvers {
const // (undocumented)
idMatchingUserEntityAnnotation: SignInResolverFactory<
AzureEasyAuthResult,
unknown
>;
}
// (No @packageDocumentation comment for this package)
```
plugins/auth-backend-module-azure-easyauth-provider/catalog-info.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: backstage-plugin-auth-backend-module-azure-easyauth-provider
title: '@backstage/plugin-auth-backend-module-azure-easyauth-provider'
description: The azure-easyauth-provider backend module for the auth plugin.
spec:
lifecycle: experimental
type: backstage-backend-plugin-module
owner: maintainers
plugins/auth-backend-module-azure-easyauth-provider/package.json
+48
View File
@@ -0,0 +1,48 @@
{
"name": "@backstage/plugin-auth-backend-module-azure-easyauth-provider",
"version": "0.0.0",
"description": "The azure-easyauth-provider backend module for the auth plugin.",
"backstage": {
"role": "backend-plugin-module"
},
"publishConfig": {
"access": "public",
"main": "dist/index.cjs.js",
"types": "dist/index.d.ts"
},
"repository": {
"type": "git",
"url": "https://github.com/backstage/backstage",
"directory": "plugins/auth-backend-module-azure-easyauth-provider"
},
"license": "Apache-2.0",
"main": "src/index.ts",
"types": "src/index.ts",
"files": [
"dist"
],
"scripts": {
"build": "backstage-cli package build",
"clean": "backstage-cli package clean",
"lint": "backstage-cli package lint",
"prepack": "backstage-cli package prepack",
"postpack": "backstage-cli package postpack",
"start": "backstage-cli package start",
"test": "backstage-cli package test"
},
"dependencies": {
"@backstage/backend-plugin-api": "workspace:^",
"@backstage/catalog-model": "workspace:^",
"@backstage/errors": "workspace:^",
"@backstage/plugin-auth-node": "workspace:^",
"@types/passport": "^1.0.16",
"express": "^4.19.2",
"jose": "^5.0.0",
"passport": "^0.7.0"
},
"devDependencies": {
"@backstage/backend-test-utils": "workspace:^",
"@backstage/cli": "workspace:^",
"@backstage/plugin-auth-backend": "workspace:^"
}
}
plugins/auth-backend-module-azure-easyauth-provider/src/authenticator.test.ts
+116
View File
@@ -0,0 +1,116 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import {
azureEasyAuthAuthenticator,
ID_TOKEN_HEADER,
ACCESS_TOKEN_HEADER,
} from './authenticator';
import { mockServices } from '@backstage/backend-test-utils';
import { Request } from 'express';
import { SignJWT, JWTPayload, errors as JoseErrors } from 'jose';
import { randomBytes } from 'crypto';
const jwtSecret = randomBytes(48);
async function buildJwt(claims: JWTPayload) {
return await new SignJWT(claims)
.setProtectedHeader({ alg: 'HS256' })
.sign(jwtSecret);
}
function mockRequest(headers?: Record<string, string>) {
return {
header: (name: string) => headers?.[name],
} as unknown as Request;
}
describe('EasyAuthAuthProvider', () => {
const ctx = azureEasyAuthAuthenticator.initialize({
config: mockServices.rootConfig(),
});
describe('should succeed when', () => {
const claims = {
ver: '2.0',
oid: 'c43063d4-0650-4f3e-ba6b-307473d24dfd',
name: 'Alice Bob',
email: 'alice@bob.com',
preferred_username: 'Another name',
};
it('valid id_token provided', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt(claims),
});
await expect(
azureEasyAuthAuthenticator.authenticate({ req: request }, ctx),
).resolves.toEqual({
result: {
fullProfile: {
provider: 'easyauth',
id: 'c43063d4-0650-4f3e-ba6b-307473d24dfd',
displayName: 'Alice Bob',
emails: [{ value: 'alice@bob.com' }],
username: 'Another name',
},
accessToken: undefined,
},
providerInfo: {
accessToken: undefined,
},
});
});
it('valid id_token and access_token provided', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt(claims),
[ACCESS_TOKEN_HEADER]: 'ACCESS_TOKEN',
});
await expect(
azureEasyAuthAuthenticator.authenticate({ req: request }, ctx),
).resolves.toMatchObject({
result: { accessToken: 'ACCESS_TOKEN' },
providerInfo: { accessToken: 'ACCESS_TOKEN' },
});
});
});
describe('should fail when', () => {
it('id token is missing', async () => {
const request = mockRequest();
await expect(
azureEasyAuthAuthenticator.authenticate({ req: request }, ctx),
).rejects.toThrow('Missing x-ms-token-aad-id-token header');
});
it('id token is invalid', async () => {
const request = mockRequest({ [ID_TOKEN_HEADER]: 'not-a-jwt' });
await expect(
azureEasyAuthAuthenticator.authenticate({ req: request }, ctx),
).rejects.toThrow(JoseErrors.JWTInvalid);
});
it('id token is v1', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt({ ver: '1.0' }),
});
await expect(
azureEasyAuthAuthenticator.authenticate({ req: request }, ctx),
).rejects.toThrow('id_token is not version 2.0');
});
});
});
plugins/auth-backend-module-azure-easyauth-provider/src/authenticator.ts
+77
View File
@@ -0,0 +1,77 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { AuthenticationError } from '@backstage/errors';
import { createProxyAuthenticator } from '@backstage/plugin-auth-node';
import { AzureEasyAuthResult } from './types';
import { Request } from 'express';
import { Profile } from 'passport';
import { decodeJwt } from 'jose';
export const ID_TOKEN_HEADER = 'x-ms-token-aad-id-token';
export const ACCESS_TOKEN_HEADER = 'x-ms-token-aad-access-token';
/** @public */
export const azureEasyAuthAuthenticator = createProxyAuthenticator({
defaultProfileTransform: async (result: AzureEasyAuthResult) => {
return {
profile: {
displayName: result.fullProfile.displayName,
email: result.fullProfile.emails?.[0].value,
picture: result.fullProfile.photos?.[0].value,
},
};
},
initialize() {},
async authenticate({ req }) {
const result = await getResult(req);
return {
result,
providerInfo: {
accessToken: result.accessToken,
},
};
},
});
async function getResult(req: Request): Promise<AzureEasyAuthResult> {
const idToken = req.header(ID_TOKEN_HEADER);
const accessToken = req.header(ACCESS_TOKEN_HEADER);
if (idToken === undefined) {
throw new AuthenticationError(`Missing ${ID_TOKEN_HEADER} header`);
}
return {
fullProfile: idTokenToProfile(idToken),
accessToken: accessToken,
};
}
function idTokenToProfile(idToken: string) {
const claims = decodeJwt(idToken);
if (claims.ver !== '2.0') {
throw new Error('id_token is not version 2.0 ');
}
return {
id: claims.oid,
displayName: claims.name,
provider: 'easyauth',
emails: [{ value: claims.email }],
username: claims.preferred_username,
} as Profile;
}
plugins/auth-backend-module-azure-easyauth-provider/src/index.ts
+20
View File
@@ -0,0 +1,20 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
export { authModuleAzureEasyAuthProvider as default } from './module';
export { azureEasyAuthAuthenticator } from './authenticator';
export { azureEasyAuthSignInResolvers } from './resolvers';
export type { AzureEasyAuthResult } from './types';
plugins/auth-backend-module-azure-easyauth-provider/src/module.test.ts
+92
View File
@@ -0,0 +1,92 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { mockServices, startTestBackend } from '@backstage/backend-test-utils';
import authPlugin from '@backstage/plugin-auth-backend';
import { authModuleAzureEasyAuthProvider } from './module';
const rootConfig = mockServices.rootConfig.factory({
data: {
app: {
baseUrl: 'http://localhost:3000',
},
auth: {
providers: {
azureEasyAuth: {
signIn: {
resolvers: [{ resolver: 'idMatchingUserEntityAnnotation' }],
},
},
},
},
},
});
const features = [authPlugin, authModuleAzureEasyAuthProvider, rootConfig];
describe('authModuleAzureEasyAuthProvider', () => {
const env = process.env;
beforeEach(() => {
jest.resetModules();
process.env = { ...env };
});
afterEach(() => {
process.env = env;
});
it('should fail when run outside of Azure App Services', async () => {
await expect(startTestBackend({ features })).rejects.toThrow(
'Backstage is not running on Azure App Services',
);
});
it('should fail when Azure App Services Auth is not enabled', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'False';
await expect(startTestBackend({ features })).rejects.toThrow(
'Azure App Services does not have authentication enabled',
);
});
it('should fail when Azure App Services Auth is not AAD', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'True';
process.env.WEBSITE_AUTH_DEFAULT_PROVIDER = 'Facebook';
await expect(startTestBackend({ features })).rejects.toThrow(
'Authentication provider is not Entra ID',
);
});
it('should fail when Token Store not enabled', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'True';
process.env.WEBSITE_AUTH_DEFAULT_PROVIDER = 'AzureActiveDirectory';
process.env.WEBSITE_AUTH_TOKEN_STORE = 'False';
await expect(startTestBackend({ features })).rejects.toThrow(
'Token Store is not enabled',
);
});
it('should start successfully when running in Azure App Services with AAD Auth', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'True';
process.env.WEBSITE_AUTH_DEFAULT_PROVIDER = 'AzureActiveDirectory';
process.env.WEBSITE_AUTH_TOKEN_STORE = 'True';
await expect(startTestBackend({ features })).resolves.toBeInstanceOf(
Object,
);
});
});
plugins/auth-backend-module-azure-easyauth-provider/src/module.ts
+73
View File
@@ -0,0 +1,73 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { createBackendModule } from '@backstage/backend-plugin-api';
import {
authProvidersExtensionPoint,
commonSignInResolvers,
createProxyAuthProviderFactory,
} from '@backstage/plugin-auth-node';
import { azureEasyAuthAuthenticator } from './authenticator';
import { azureEasyAuthSignInResolvers } from './resolvers';
/** @public */
export const authModuleAzureEasyAuthProvider = createBackendModule({
pluginId: 'auth',
moduleId: 'azure-easyauth-provider',
register(reg) {
reg.registerInit({
deps: {
providers: authProvidersExtensionPoint,
},
async init({ providers }) {
validateAppServiceConfiguration(process.env);
providers.registerProvider({
providerId: 'azureEasyAuth',
factory: createProxyAuthProviderFactory({
authenticator: azureEasyAuthAuthenticator,
signInResolverFactories: {
...commonSignInResolvers,
...azureEasyAuthSignInResolvers,
},
}),
});
},
});
},
});
function validateAppServiceConfiguration(env: NodeJS.ProcessEnv) {
// Based on https://github.com/AzureAD/microsoft-identity-web/blob/f7403779d1a91f4a3fec0ed0993bd82f50f299e1/src/Microsoft.Identity.Web/AppServicesAuth/AppServicesAuthenticationInformation.cs#L38-L59
//
// It's critical to validate we're really running in a correctly configured Azure App Services,
// As we rely on App Services to manage & validate the ID and Access Token headers
// Without that, this users can be trivially impersonated.
if (env.WEBSITE_SKU === undefined) {
throw new Error('Backstage is not running on Azure App Services');
}
if (env.WEBSITE_AUTH_ENABLED?.toLocaleLowerCase('en-US') !== 'true') {
throw new Error('Azure App Services does not have authentication enabled');
}
if (
env.WEBSITE_AUTH_DEFAULT_PROVIDER?.toLocaleLowerCase('en-US') !==
'azureactivedirectory'
) {
throw new Error('Authentication provider is not Entra ID');
}
if (env.WEBSITE_AUTH_TOKEN_STORE?.toLocaleLowerCase('en-US') !== 'true') {
throw new Error('Token Store is not enabled');
}
}
plugins/auth-backend-module-azure-easyauth-provider/src/resolvers.ts
+44
View File
@@ -0,0 +1,44 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import {
createSignInResolverFactory,
SignInInfo,
} from '@backstage/plugin-auth-node';
import { AzureEasyAuthResult } from './types';
/** @public */
export namespace azureEasyAuthSignInResolvers {
export const idMatchingUserEntityAnnotation = createSignInResolverFactory({
create() {
return async (info: SignInInfo<AzureEasyAuthResult>, ctx) => {
const {
fullProfile: { id },
} = info.result;
if (!id) {
throw new Error('User profile contained no id');
}
return await ctx.signInWithCatalogUser({
annotations: {
'graph.microsoft.com/user-id': id,
},
});
};
},
});
}
plugins/auth-backend-module-azure-easyauth-provider/src/types.ts
+23
View File
@@ -0,0 +1,23 @@
/*
* Copyright 2024 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { Profile } from 'passport';
/** @public */
export type AzureEasyAuthResult = {
fullProfile: Profile;
accessToken?: string;
};
plugins/auth-backend/api-report.md
+5 -7
View File
@@ -10,6 +10,7 @@ import { AuthResolverCatalogUserQuery as AuthResolverCatalogUserQuery_2 } from '
import { AuthResolverContext as AuthResolverContext_2 } from '@backstage/plugin-auth-node';
import { AuthService } from '@backstage/backend-plugin-api';
import { AwsAlbResult as AwsAlbResult_2 } from '@backstage/plugin-auth-backend-module-aws-alb-provider';
import { AzureEasyAuthResult } from '@backstage/plugin-auth-backend-module-azure-easyauth-provider';
import { BackendFeature } from '@backstage/backend-plugin-api';
import { BackstageSignInResult } from '@backstage/plugin-auth-node';
import { CacheService } from '@backstage/backend-plugin-api';
@@ -199,11 +200,8 @@ export const defaultAuthProviderFactories: {
[providerId: string]: AuthProviderFactory_2;
};
// @public (undocumented)
export type EasyAuthResult = {
fullProfile: Profile;
accessToken?: string;
};
// @public @deprecated (undocumented)
export type EasyAuthResult = AzureEasyAuthResult;
// @public @deprecated (undocumented)
export const encodeState: typeof encodeOAuthState;
@@ -634,9 +632,9 @@ export const providers: Readonly<{
create: (
options?:
| {
authHandler?: AuthHandler<EasyAuthResult> | undefined;
authHandler?: AuthHandler<AzureEasyAuthResult> | undefined;
signIn: {
resolver: SignInResolver_2<EasyAuthResult>;
resolver: SignInResolver_2<AzureEasyAuthResult>;
};
}
| undefined,
plugins/auth-backend/package.json
+1
View File
@@ -45,6 +45,7 @@
"@backstage/errors": "workspace:^",
"@backstage/plugin-auth-backend-module-atlassian-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-aws-alb-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-azure-easyauth-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-cloudflare-access-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-gcp-iap-provider": "workspace:^",
"@backstage/plugin-auth-backend-module-github-provider": "workspace:^",
plugins/auth-backend/src/providers/azure-easyauth/index.ts
+7 -1
View File
@@ -15,4 +15,10 @@
*/
export { easyAuth } from './provider';
export type { EasyAuthResult } from './provider';
import { AzureEasyAuthResult } from '@backstage/plugin-auth-backend-module-azure-easyauth-provider';
/**
* @public
* @deprecated import AzureEasyAuthResult from `@backstage/plugin-auth-backend-module-azure-easyauth-provider` instead
*/
export type EasyAuthResult = AzureEasyAuthResult;
plugins/auth-backend/src/providers/azure-easyauth/provider.test.ts
-293
View File
@@ -1,293 +0,0 @@
/*
* Copyright 2020 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { AuthHandler } from '../types';
import { makeProfileInfo } from '../../lib/passport';
import {
easyAuth,
ACCESS_TOKEN_HEADER,
EasyAuthAuthProvider,
EasyAuthResult,
ID_TOKEN_HEADER,
} from './provider';
import { Request, Response } from 'express';
import { SignJWT, JWTPayload, errors as JoseErrors } from 'jose';
import { randomBytes } from 'crypto';
import { AuthResolverContext } from '@backstage/plugin-auth-node';
const jwtSecret = randomBytes(48);
async function buildJwt(claims: JWTPayload) {
return await new SignJWT(claims)
.setProtectedHeader({ alg: 'HS256' })
.sign(jwtSecret);
}
const backstageIdentityTokenClaims = {
sub: 'user:default/alice',
ent: ['user:default/alice'],
};
describe('EasyAuthAuthProvider', () => {
const authHandler: AuthHandler<EasyAuthResult> = async ({ fullProfile }) => ({
profile: makeProfileInfo(fullProfile),
});
const resolverContext: AuthResolverContext = {} as AuthResolverContext;
async function signInResolver() {
return {
id: 'user.name',
token: await buildJwt(backstageIdentityTokenClaims),
};
}
const provider = new EasyAuthAuthProvider({
authHandler,
signInResolver,
resolverContext,
});
function mockRequest(headers?: Record<string, string>) {
return {
header: (name: string) => headers?.[name],
} as unknown as Request;
}
describe('should succeed when', () => {
it('id_token is valid and identity is resolved successfully', async () => {
const claims = {
ver: '2.0',
oid: 'c43063d4-0650-4f3e-ba6b-307473d24dfd',
name: 'Alice Bob',
email: 'alice@bob.com',
preferred_username: 'Another name',
};
const response = {
end: jest.fn(),
header: () => jest.fn(),
json: jest.fn(),
status: jest.fn(),
} as unknown as Response;
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt(claims),
});
await provider.refresh(request, response);
expect(response.json).toHaveBeenCalledWith({
backstageIdentity: {
id: 'user.name',
token: await buildJwt(backstageIdentityTokenClaims),
identity: {
ownershipEntityRefs: ['user:default/alice'],
type: 'user',
userEntityRef: 'user:default/alice',
},
},
profile: {
displayName: claims.name,
email: claims.email,
picture: undefined,
},
providerInfo: {
accessToken: undefined,
},
});
});
it('valid id_token and access_token provided', async () => {
const claims = {
ver: '2.0',
oid: 'c43063d4-0650-4f3e-ba6b-307473d24dfd',
name: 'Alice Bob',
email: 'alice@bob.com',
preferred_username: 'Another name',
};
const response = {
end: jest.fn(),
header: () => jest.fn(),
json: jest.fn(),
status: jest.fn(),
} as unknown as Response;
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt(claims),
[ACCESS_TOKEN_HEADER]: 'ACCESS_TOKEN',
});
await provider.refresh(request, response);
expect(response.json).toHaveBeenCalledWith(
expect.objectContaining({
providerInfo: {
accessToken: 'ACCESS_TOKEN',
},
}),
);
});
});
describe('should fail when', () => {
const response = {} as Response;
it('Access token is missing', async () => {
const request = mockRequest();
await expect(provider.refresh(request, response)).rejects.toThrow(
'Missing x-ms-token-aad-id-token header',
);
});
it('id token is invalid', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: 'not-a-jwt',
});
await expect(provider.refresh(request, response)).rejects.toThrow(
JoseErrors.JWTInvalid,
);
});
it('id token is v1', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt({ ver: '1.0' }),
});
await expect(provider.refresh(request, response)).rejects.toThrow(
'id_token is not version 2.0',
);
});
it('SignInResolver rejects', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt({ ver: '2.0' }),
});
const rejectProvider = new EasyAuthAuthProvider({
authHandler,
signInResolver: async () => {
throw new Error('REJECTED!!');
},
resolverContext,
});
await expect(rejectProvider.refresh(request, response)).rejects.toThrow(
'REJECTED!!',
);
});
it('AuthHanlder rejects', async () => {
const request = mockRequest({
[ID_TOKEN_HEADER]: await buildJwt({ ver: '2.0' }),
});
const rejectProvider = new EasyAuthAuthProvider({
authHandler: async () => {
throw new Error('OBJECTION!!');
},
signInResolver,
resolverContext,
});
await expect(rejectProvider.refresh(request, response)).rejects.toThrow(
'OBJECTION!!',
);
});
});
});
describe('easyAuth factory', () => {
const env = process.env;
beforeEach(() => {
jest.resetModules();
process.env = { ...env };
});
afterEach(() => {
process.env = env;
});
it('should fail when run outside of Azure App Services', async () => {
const factory = easyAuth.create({
signIn: {
resolver: jest.fn(),
},
});
expect(() => factory({} as any)).toThrow(
'Backstage is not running on Azure App Services',
);
});
it('should fail when Azure App Services Auth is not enabled', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'False';
const factory = easyAuth.create({
signIn: {
resolver: jest.fn(),
},
});
expect(() => factory({} as any)).toThrow(
'Azure App Services does not have authentication enabled',
);
});
it('should fail when Azure App Services Auth is not AAD', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'True';
process.env.WEBSITE_AUTH_DEFAULT_PROVIDER = 'Facebook';
const factory = easyAuth.create({
signIn: {
resolver: jest.fn(),
},
});
expect(() => factory({} as any)).toThrow(
'Authentication provider is not Entra ID',
);
});
it('should fail when Token Store not enabled', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'True';
process.env.WEBSITE_AUTH_DEFAULT_PROVIDER = 'AzureActiveDirectory';
process.env.WEBSITE_AUTH_TOKEN_STORE = 'False';
const factory = easyAuth.create({
signIn: {
resolver: jest.fn(),
},
});
expect(() => factory({} as any)).toThrow('Token Store is not enabled');
});
it('should return EasyAuthAuthProvider when running in Azure App Services with AAD Auth', async () => {
process.env.WEBSITE_SKU = 'Standard';
process.env.WEBSITE_AUTH_ENABLED = 'True';
process.env.WEBSITE_AUTH_DEFAULT_PROVIDER = 'AzureActiveDirectory';
process.env.WEBSITE_AUTH_TOKEN_STORE = 'True';
const factory = easyAuth.create({
signIn: {
resolver: jest.fn(),
},
});
expect(factory({} as any)).toBeInstanceOf(EasyAuthAuthProvider);
});
});
plugins/auth-backend/src/providers/azure-easyauth/provider.ts
+13 -147
View File
@@ -14,114 +14,18 @@
* limitations under the License.
*/
import { AuthHandler } from '../types';
import { Request, Response } from 'express';
import { makeProfileInfo } from '../../lib/passport';
import { AuthenticationError } from '@backstage/errors';
import { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';
import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
import { Profile } from 'passport';
import { decodeJwt } from 'jose';
import {
AuthProviderRouteHandlers,
AuthResolverContext,
ClientAuthResponse,
SignInResolver,
createProxyAuthProviderFactory,
} from '@backstage/plugin-auth-node';
import { AuthHandler } from '../types';
import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
import {
AzureEasyAuthResult,
azureEasyAuthAuthenticator,
} from '@backstage/plugin-auth-backend-module-azure-easyauth-provider';
export const ID_TOKEN_HEADER = 'x-ms-token-aad-id-token';
export const ACCESS_TOKEN_HEADER = 'x-ms-token-aad-access-token';
type Options = {
authHandler: AuthHandler<EasyAuthResult>;
signInResolver: SignInResolver<EasyAuthResult>;
resolverContext: AuthResolverContext;
};
/** @public */
export type EasyAuthResult = {
fullProfile: Profile;
accessToken?: string;
};
export type EasyAuthResponse = ClientAuthResponse<{}>;
export class EasyAuthAuthProvider implements AuthProviderRouteHandlers {
private readonly resolverContext: AuthResolverContext;
private readonly authHandler: AuthHandler<EasyAuthResult>;
private readonly signInResolver: SignInResolver<EasyAuthResult>;
constructor(options: Options) {
this.authHandler = options.authHandler;
this.signInResolver = options.signInResolver;
this.resolverContext = options.resolverContext;
}
frameHandler(): Promise<void> {
return Promise.resolve(undefined);
}
async refresh(req: Request, res: Response): Promise<void> {
const result = await this.getResult(req);
const response = await this.handleResult(result);
res.json(response);
}
start(): Promise<void> {
return Promise.resolve(undefined);
}
private async getResult(req: Request): Promise<EasyAuthResult> {
const idToken = req.header(ID_TOKEN_HEADER);
const accessToken = req.header(ACCESS_TOKEN_HEADER);
if (idToken === undefined) {
throw new AuthenticationError(`Missing ${ID_TOKEN_HEADER} header`);
}
return {
fullProfile: this.idTokenToProfile(idToken),
accessToken: accessToken,
};
}
private idTokenToProfile(idToken: string) {
const claims = decodeJwt(idToken);
if (claims.ver !== '2.0') {
throw new Error('id_token is not version 2.0 ');
}
return {
id: claims.oid,
displayName: claims.name,
provider: 'easyauth',
emails: [{ value: claims.email }],
username: claims.preferred_username,
} as Profile;
}
private async handleResult(
result: EasyAuthResult,
): Promise<EasyAuthResponse> {
const { profile } = await this.authHandler(result, this.resolverContext);
const backstageIdentity = await this.signInResolver(
{
result,
profile,
},
this.resolverContext,
);
return {
providerInfo: {
accessToken: result.accessToken,
},
backstageIdentity: prepareBackstageIdentityResponse(backstageIdentity),
profile,
};
}
}
export type EasyAuthResult = AzureEasyAuthResult;
/**
* Auth provider integration for Azure EasyAuth
@@ -146,48 +50,10 @@ export const easyAuth = createAuthProviderIntegration({
resolver: SignInResolver<EasyAuthResult>;
};
}) {
return ({ resolverContext }) => {
validateAppServiceConfiguration(process.env);
if (options?.signIn.resolver === undefined) {
throw new Error(
'SignInResolver is required to use this authentication provider',
);
}
const authHandler =
options.authHandler ??
(async ({ fullProfile }) => ({
profile: makeProfileInfo(fullProfile),
}));
return new EasyAuthAuthProvider({
signInResolver: options.signIn.resolver,
authHandler,
resolverContext,
});
};
return createProxyAuthProviderFactory({
authenticator: azureEasyAuthAuthenticator,
profileTransform: options?.authHandler,
signInResolver: options?.signIn?.resolver,
});
},
});
function validateAppServiceConfiguration(env: NodeJS.ProcessEnv) {
// Based on https://github.com/AzureAD/microsoft-identity-web/blob/f7403779d1a91f4a3fec0ed0993bd82f50f299e1/src/Microsoft.Identity.Web/AppServicesAuth/AppServicesAuthenticationInformation.cs#L38-L59
//
// It's critical to validate we're really running in a correctly configured Azure App Services,
// As we rely on App Services to manage & validate the ID and Access Token headers
// Without that, this users can be trivially impersonated.
if (env.WEBSITE_SKU === undefined) {
throw new Error('Backstage is not running on Azure App Services');
}
if (env.WEBSITE_AUTH_ENABLED?.toLowerCase() !== 'true') {
throw new Error('Azure App Services does not have authentication enabled');
}
if (
env.WEBSITE_AUTH_DEFAULT_PROVIDER?.toLowerCase() !== 'azureactivedirectory'
) {
throw new Error('Authentication provider is not Entra ID');
}
if (process.env.WEBSITE_AUTH_TOKEN_STORE?.toLowerCase() !== 'true') {
throw new Error('Token Store is not enabled');
}
}
yarn.lock
+21 -2
View File
@@ -4793,6 +4793,24 @@ __metadata:
languageName: unknown
linkType: soft
"@backstage/plugin-auth-backend-module-azure-easyauth-provider@workspace:^, @backstage/plugin-auth-backend-module-azure-easyauth-provider@workspace:plugins/auth-backend-module-azure-easyauth-provider":
version: 0.0.0-use.local
resolution: "@backstage/plugin-auth-backend-module-azure-easyauth-provider@workspace:plugins/auth-backend-module-azure-easyauth-provider"
dependencies:
"@backstage/backend-plugin-api": "workspace:^"
"@backstage/backend-test-utils": "workspace:^"
"@backstage/catalog-model": "workspace:^"
"@backstage/cli": "workspace:^"
"@backstage/errors": "workspace:^"
"@backstage/plugin-auth-backend": "workspace:^"
"@backstage/plugin-auth-node": "workspace:^"
"@types/passport": ^1.0.16
express: ^4.19.2
jose: ^5.0.0
passport: ^0.7.0
languageName: unknown
linkType: soft
"@backstage/plugin-auth-backend-module-cloudflare-access-provider@workspace:^, @backstage/plugin-auth-backend-module-cloudflare-access-provider@workspace:plugins/auth-backend-module-cloudflare-access-provider":
version: 0.0.0-use.local
resolution: "@backstage/plugin-auth-backend-module-cloudflare-access-provider@workspace:plugins/auth-backend-module-cloudflare-access-provider"
@@ -5047,6 +5065,7 @@ __metadata:
"@backstage/errors": "workspace:^"
"@backstage/plugin-auth-backend-module-atlassian-provider": "workspace:^"
"@backstage/plugin-auth-backend-module-aws-alb-provider": "workspace:^"
"@backstage/plugin-auth-backend-module-azure-easyauth-provider": "workspace:^"
"@backstage/plugin-auth-backend-module-cloudflare-access-provider": "workspace:^"
"@backstage/plugin-auth-backend-module-gcp-iap-provider": "workspace:^"
"@backstage/plugin-auth-backend-module-github-provider": "workspace:^"
@@ -19420,7 +19439,7 @@ __metadata:
languageName: node
linkType: hard
"@types/passport@npm:*, @types/passport@npm:^1.0.11, @types/passport@npm:^1.0.3":
"@types/passport@npm:*, @types/passport@npm:^1.0.11, @types/passport@npm:^1.0.16, @types/passport@npm:^1.0.3":
version: 1.0.16
resolution: "@types/passport@npm:1.0.16"
dependencies:
@@ -27856,7 +27875,7 @@ __metadata:
languageName: node
linkType: hard
"express@npm:^4.14.0, express@npm:^4.17.1, express@npm:^4.17.3, express@npm:^4.18.1, express@npm:^4.18.2":
"express@npm:^4.14.0, express@npm:^4.17.1, express@npm:^4.17.3, express@npm:^4.18.1, express@npm:^4.18.2, express@npm:^4.19.2":
version: 4.19.2
resolution: "express@npm:4.19.2"
dependencies: