From 80b9027eb74f791730983bf59ce701e215aa87f7 Mon Sep 17 00:00:00 2001 From: elonj Date: Wed, 26 Jan 2022 17:27:32 -0500 Subject: [PATCH 1/4] oidc and googld subs will be full entity refs Signed-off-by: elonj --- .../src/providers/google/provider.ts | 2 +- .../src/providers/oidc/provider.ts | 28 ++++++++++--------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts index 90e68c6f9c..44c22f757e 100644 --- a/plugins/auth-backend/src/providers/google/provider.ts +++ b/plugins/auth-backend/src/providers/google/provider.ts @@ -227,7 +227,7 @@ const googleDefaultSignInResolver: SignInResolver = async ( } const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: userId, ent: [`user:default/${userId}`] }, + claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }, }); return { id: userId, token }; diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index 5ffbf070bd..cff7438da1 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -211,20 +211,22 @@ export class OidcAuthProvider implements OAuthHandlers { } } -export const oAuth2DefaultSignInResolver: SignInResolver< - OidcAuthResult -> = async (info, ctx) => { - const { profile } = info; +export const oAuth2DefaultSignInResolver: SignInResolver = + async (info, ctx) => { + const { profile } = info; - if (!profile.email) { - throw new Error('Profile contained no email'); - } - const userId = profile.email.split('@')[0]; - const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: userId, ent: [`user:default/${userId}`] }, - }); - return { id: userId, token }; -}; + if (!profile.email) { + throw new Error('Profile contained no email'); + } + const userId = profile.email.split('@')[0]; + const token = await ctx.tokenIssuer.issueToken({ + claims: { + sub: `user:default/${userId}`, + ent: [`user:default/${userId}`], + }, + }); + return { id: userId, token }; + }; /** * OIDC provider callback options. An auth handler and a sign in resolver From 67349916ac6512eb5d74973cfa7043c4762998ea Mon Sep 17 00:00:00 2001 From: elonj Date: Wed, 26 Jan 2022 17:30:14 -0500 Subject: [PATCH 2/4] changeset Signed-off-by: elonj --- .changeset/honest-rockets-sit.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/honest-rockets-sit.md diff --git a/.changeset/honest-rockets-sit.md b/.changeset/honest-rockets-sit.md new file mode 100644 index 0000000000..9992837b32 --- /dev/null +++ b/.changeset/honest-rockets-sit.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': minor +--- + +Google and OIDC token subs will be full entity ref From 53acf95366e500210cd2890b4e2d920e990ab7b3 Mon Sep 17 00:00:00 2001 From: elonj Date: Wed, 26 Jan 2022 17:55:05 -0500 Subject: [PATCH 3/4] prettier in ADOPTERS.md file Signed-off-by: elonj --- ADOPTERS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ADOPTERS.md b/ADOPTERS.md index 21b5b131a9..b95e20757d 100644 --- a/ADOPTERS.md +++ b/ADOPTERS.md @@ -84,4 +84,4 @@ | [Livspace](https://www.livspace.com) | [Praveen Kumar](https://github.com/praveen-livspace) | Developer portal, service catalog, tech docs, API docs and plugins | | [Just Eat Takeaway](https://www.justeattakeaway.com) | [Kim Wilson](https://github.com/kwilson541) | Our developer portal which centralises applications, reduces cognitive load and provides teams insights. | | [Hopin](https://hopin.com) | [Vladimir Glafirov](https://github.com/vglafirov), [Chloe Lee](https://github.com/msfuko) | Developer portal to streamline the development practices. Integrated with service catalog, software templates, application monitoring, tech docs and plugins. | -| [HBO Max](https://hbomax.com) | [@mdb](https://github.com/mdb), [@nesta219](https://github.com/nesta219), [@nmische](https://github.com/nmische), [@hbomark](https://github.com/hbomark) | Developer portal hosting service catalog and API documentation, as well as cloud infrastructure details, operational visibility tools, and a custom plugin for browsing notable platform change events, such as deployments and configuration updates. | +| [HBO Max](https://hbomax.com) | [@mdb](https://github.com/mdb), [@nesta219](https://github.com/nesta219), [@nmische](https://github.com/nmische), [@hbomark](https://github.com/hbomark) | Developer portal hosting service catalog and API documentation, as well as cloud infrastructure details, operational visibility tools, and a custom plugin for browsing notable platform change events, such as deployments and configuration updates. | From 26c7fca6bef15460b06ce9039a75bbe699a2ec6f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Thu, 27 Jan 2022 10:52:00 +0100 Subject: [PATCH 4/4] auth-backend: prettier + changeset tweak Signed-off-by: Patrik Oldsberg --- .changeset/honest-rockets-sit.md | 2 +- ADOPTERS.md | 2 +- .../src/providers/oidc/provider.ts | 31 ++++++++++--------- 3 files changed, 18 insertions(+), 17 deletions(-) diff --git a/.changeset/honest-rockets-sit.md b/.changeset/honest-rockets-sit.md index 9992837b32..e63884bcb4 100644 --- a/.changeset/honest-rockets-sit.md +++ b/.changeset/honest-rockets-sit.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend': minor --- -Google and OIDC token subs will be full entity ref +The `sub` claim in Backstage tokens generated by the default Google and OIDC sign-in resolvers are now full entity references of the format `:/`. diff --git a/ADOPTERS.md b/ADOPTERS.md index b95e20757d..21b5b131a9 100644 --- a/ADOPTERS.md +++ b/ADOPTERS.md @@ -84,4 +84,4 @@ | [Livspace](https://www.livspace.com) | [Praveen Kumar](https://github.com/praveen-livspace) | Developer portal, service catalog, tech docs, API docs and plugins | | [Just Eat Takeaway](https://www.justeattakeaway.com) | [Kim Wilson](https://github.com/kwilson541) | Our developer portal which centralises applications, reduces cognitive load and provides teams insights. | | [Hopin](https://hopin.com) | [Vladimir Glafirov](https://github.com/vglafirov), [Chloe Lee](https://github.com/msfuko) | Developer portal to streamline the development practices. Integrated with service catalog, software templates, application monitoring, tech docs and plugins. | -| [HBO Max](https://hbomax.com) | [@mdb](https://github.com/mdb), [@nesta219](https://github.com/nesta219), [@nmische](https://github.com/nmische), [@hbomark](https://github.com/hbomark) | Developer portal hosting service catalog and API documentation, as well as cloud infrastructure details, operational visibility tools, and a custom plugin for browsing notable platform change events, such as deployments and configuration updates. | +| [HBO Max](https://hbomax.com) | [@mdb](https://github.com/mdb), [@nesta219](https://github.com/nesta219), [@nmische](https://github.com/nmische), [@hbomark](https://github.com/hbomark) | Developer portal hosting service catalog and API documentation, as well as cloud infrastructure details, operational visibility tools, and a custom plugin for browsing notable platform change events, such as deployments and configuration updates. | diff --git a/plugins/auth-backend/src/providers/oidc/provider.ts b/plugins/auth-backend/src/providers/oidc/provider.ts index cff7438da1..0c820648e4 100644 --- a/plugins/auth-backend/src/providers/oidc/provider.ts +++ b/plugins/auth-backend/src/providers/oidc/provider.ts @@ -211,22 +211,23 @@ export class OidcAuthProvider implements OAuthHandlers { } } -export const oAuth2DefaultSignInResolver: SignInResolver = - async (info, ctx) => { - const { profile } = info; +export const oAuth2DefaultSignInResolver: SignInResolver< + OidcAuthResult +> = async (info, ctx) => { + const { profile } = info; - if (!profile.email) { - throw new Error('Profile contained no email'); - } - const userId = profile.email.split('@')[0]; - const token = await ctx.tokenIssuer.issueToken({ - claims: { - sub: `user:default/${userId}`, - ent: [`user:default/${userId}`], - }, - }); - return { id: userId, token }; - }; + if (!profile.email) { + throw new Error('Profile contained no email'); + } + const userId = profile.email.split('@')[0]; + const token = await ctx.tokenIssuer.issueToken({ + claims: { + sub: `user:default/${userId}`, + ent: [`user:default/${userId}`], + }, + }); + return { id: userId, token }; +}; /** * OIDC provider callback options. An auth handler and a sign in resolver