diff --git a/.changeset/spicy-walls-repair.md b/.changeset/spicy-walls-repair.md new file mode 100644 index 0000000000..36187600c7 --- /dev/null +++ b/.changeset/spicy-walls-repair.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Add new config option for okta auth server and IDP diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index 35394094f8..e4fc8bfb45 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -41,6 +41,8 @@ auth: clientId: ${AUTH_OKTA_CLIENT_ID} clientSecret: ${AUTH_OKTA_CLIENT_SECRET} audience: ${AUTH_OKTA_DOMAIN} + authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional + idp: ${AUTH_OKTA_IDP} # Optional ``` The values referenced are found on the Application page on your Okta site. @@ -48,8 +50,10 @@ The values referenced are found on the Application page on your Okta site. - `clientId`: The client ID that you generated on Okta, e.g. `3abe134ejxzF21HU74c1` - `clientSecret`: The client secret shown for the Application. -- `audience`: The Okta domain shown for your Application, e.g. +- `audience`: The Okta domain shown for the Application, e.g. `https://company.okta.com` +- `authServerId`: The authorization server ID for the Application +- `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3` ## Adding the provider to the Backstage frontend diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index d6b027e6ea..b1c2f39e27 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -40,6 +40,7 @@ "@backstage/config": "^1.0.1", "@backstage/errors": "^1.1.0-next.0", "@backstage/types": "^1.0.0", + "@davidzemon/passport-okta-oauth": "^0.0.5", "@google-cloud/firestore": "^5.0.2", "@types/express": "^4.17.6", "@types/passport": "^1.0.3", @@ -68,7 +69,6 @@ "passport-google-oauth20": "^2.0.0", "passport-microsoft": "^1.0.0", "passport-oauth2": "^1.6.1", - "passport-okta-oauth": "^0.0.1", "passport-onelogin-oauth": "^0.0.1", "passport-saml": "^3.1.2", "uuid": "^8.0.0", diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index de9d128641..cb686f17e9 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -26,7 +26,7 @@ import { OAuthRefreshRequest, OAuthResult, } from '../../lib/oauth'; -import { Strategy as OktaStrategy } from 'passport-okta-oauth'; +import { Strategy as OktaStrategy } from '@davidzemon/passport-okta-oauth'; import passport from 'passport'; import { executeFrameHandlerStrategy, @@ -55,6 +55,8 @@ type PrivateInfo = { export type OktaAuthProviderOptions = OAuthProviderOptions & { audience: string; + authServerId?: string; + idp?: string; signInResolver?: SignInResolver; authHandler: AuthHandler; resolverContext: AuthResolverContext; @@ -94,6 +96,8 @@ export class OktaAuthProvider implements OAuthHandlers { clientSecret: options.clientSecret, callbackURL: options.callbackUrl, audience: options.audience, + authServerID: options.authServerId, + idp: options.idp, passReqToCallback: false, store: this.store, response_type: 'code', @@ -220,6 +224,8 @@ export const okta = createAuthProviderIntegration({ const clientId = envConfig.getString('clientId'); const clientSecret = envConfig.getString('clientSecret'); const audience = envConfig.getString('audience'); + const authServerId = envConfig.getOptionalString('authServerId'); + const idp = envConfig.getOptionalString('idp'); const customCallbackUrl = envConfig.getOptionalString('callbackUrl'); const callbackUrl = customCallbackUrl || @@ -240,6 +246,8 @@ export const okta = createAuthProviderIntegration({ const provider = new OktaAuthProvider({ audience, + authServerId, + idp, clientId, clientSecret, callbackUrl, diff --git a/plugins/auth-backend/src/providers/okta/types.d.ts b/plugins/auth-backend/src/providers/okta/types.d.ts deleted file mode 100644 index ab83bf89ec..0000000000 --- a/plugins/auth-backend/src/providers/okta/types.d.ts +++ /dev/null @@ -1,20 +0,0 @@ -/* - * Copyright 2020 The Backstage Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -declare module 'passport-okta-oauth' { - export class Strategy { - constructor(options: any, verify: any); - } -} diff --git a/yarn.lock b/yarn.lock index f06a187ebf..5b8110ec78 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2126,6 +2126,16 @@ dependencies: "@date-io/core" "^1.3.13" +"@davidzemon/passport-okta-oauth@^0.0.5": + version "0.0.5" + resolved "https://registry.npmjs.org/@davidzemon/passport-okta-oauth/-/passport-okta-oauth-0.0.5.tgz#905d14521f4e8b422f4074c1f7fe1cbe0c88e44b" + integrity sha512-eaC2Ve2MIoqR7dLKgpHxhVKRcfgJCes0Fozxm5SefZh/zqLNb8tGIou+dj0EbylksLmB+nVlhr8p8qwjA9n2sA== + dependencies: + "@types/passport-oauth2" "^1.4.11" + passport-oauth2 "^1.6.1" + pkginfo "^0.4.1" + uid2 "^1.0.0" + "@elastic/elasticsearch-mock@^1.0.0": version "1.0.0" resolved "https://registry.npmjs.org/@elastic/elasticsearch-mock/-/elasticsearch-mock-1.0.0.tgz#1fbaf6bf220cd74a34494ff3a8673551d9dfc66f" @@ -6806,6 +6816,15 @@ "@types/oauth" "*" "@types/passport" "*" +"@types/passport-oauth2@^1.4.11": + version "1.4.11" + resolved "https://registry.npmjs.org/@types/passport-oauth2/-/passport-oauth2-1.4.11.tgz#fbca527ecb44258774d17bcb251630c321515fa9" + integrity sha512-KUNwmGhe/3xPbjkzkPwwcPmyFwfyiSgtV1qOrPBLaU4i4q9GSCdAOyCbkFG0gUxAyEmYwqo9OAF/rjPjJ6ImdA== + dependencies: + "@types/express" "*" + "@types/oauth" "*" + "@types/passport" "*" + "@types/passport-saml@^1.1.3": version "1.1.3" resolved "https://registry.npmjs.org/@types/passport-saml/-/passport-saml-1.1.3.tgz#efc57902a07ebe1ec114d00acd8d990e873813a1" @@ -20357,15 +20376,6 @@ passport-oauth@1.0.0: passport-oauth1 "1.x.x" passport-oauth2 "1.x.x" -passport-okta-oauth@^0.0.1: - version "0.0.1" - resolved "https://registry.npmjs.org/passport-okta-oauth/-/passport-okta-oauth-0.0.1.tgz#c8bcee02af3d56ca79d3cca776f2df7cf15a5748" - integrity sha1-yLzuAq89Vsp508yndvLffPFaV0g= - dependencies: - passport-oauth "1.0.0" - pkginfo "0.2.x" - uid2 "0.0.3" - passport-onelogin-oauth@^0.0.1: version "0.0.1" resolved "https://registry.npmjs.org/passport-onelogin-oauth/-/passport-onelogin-oauth-0.0.1.tgz#6e991ac6720783fdd80d4caa08c36cc71ef19962" @@ -20760,7 +20770,7 @@ pkginfo@0.2.x: resolved "https://registry.npmjs.org/pkginfo/-/pkginfo-0.2.3.tgz#7239c42a5ef6c30b8f328439d9b9ff71042490f8" integrity sha1-cjnEKl72wwuPMoQ52bn/cQQkkPg= -pkginfo@0.4.x: +pkginfo@0.4.x, pkginfo@^0.4.1: version "0.4.1" resolved "https://registry.npmjs.org/pkginfo/-/pkginfo-0.4.1.tgz#b5418ef0439de5425fc4995042dced14fb2a84ff" integrity sha1-tUGO8EOd5UJfxJlQQtztFPsqhP8= @@ -25269,6 +25279,11 @@ uid2@0.0.3, uid2@0.0.x: resolved "https://registry.npmjs.org/uid2/-/uid2-0.0.3.tgz#483126e11774df2f71b8b639dcd799c376162b82" integrity sha1-SDEm4Rd03y9xuLY53NeZw3YWK4I= +uid2@^1.0.0: + version "1.0.0" + resolved "https://registry.npmjs.org/uid2/-/uid2-1.0.0.tgz#ef8d95a128d7c5c44defa1a3d052eecc17a06bfb" + integrity sha512-+I6aJUv63YAcY9n4mQreLUt0d4lvwkkopDNmpomkAUz0fAkEMV9pRWxN0EjhW1YfRhcuyHg2v3mwddCDW1+LFQ== + unbox-primitive@^1.0.1, unbox-primitive@^1.0.2: version "1.0.2" resolved "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.2.tgz#29032021057d5e6cdbd08c5129c226dff8ed6f9e"