From 35233735e81fb58dbdf91200933a91a3f9f2074c Mon Sep 17 00:00:00 2001 From: David Zemon Date: Thu, 30 Jun 2022 09:32:24 -0500 Subject: [PATCH 1/8] feat: [#12248] Switch to new okta strategy This new Okta passport strategy support custom authorization server IDs Signed-off-by: David Zemon --- plugins/auth-backend/package.json | 2 +- .../src/providers/okta/provider.ts | 4 +++ yarn.lock | 27 +++++++++++-------- 3 files changed, 21 insertions(+), 12 deletions(-) diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index d6b027e6ea..5ef20a1ccf 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -40,6 +40,7 @@ "@backstage/config": "^1.0.1", "@backstage/errors": "^1.1.0-next.0", "@backstage/types": "^1.0.0", + "@davidzemon/passport-okta-oauth": "^0.0.4-2", "@google-cloud/firestore": "^5.0.2", "@types/express": "^4.17.6", "@types/passport": "^1.0.3", @@ -68,7 +69,6 @@ "passport-google-oauth20": "^2.0.0", "passport-microsoft": "^1.0.0", "passport-oauth2": "^1.6.1", - "passport-okta-oauth": "^0.0.1", "passport-onelogin-oauth": "^0.0.1", "passport-saml": "^3.1.2", "uuid": "^8.0.0", diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index de9d128641..b11df1291e 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -55,6 +55,7 @@ type PrivateInfo = { export type OktaAuthProviderOptions = OAuthProviderOptions & { audience: string; + authServerId?: string; signInResolver?: SignInResolver; authHandler: AuthHandler; resolverContext: AuthResolverContext; @@ -94,6 +95,7 @@ export class OktaAuthProvider implements OAuthHandlers { clientSecret: options.clientSecret, callbackURL: options.callbackUrl, audience: options.audience, + authServerID: options.authServerId, passReqToCallback: false, store: this.store, response_type: 'code', @@ -220,6 +222,7 @@ export const okta = createAuthProviderIntegration({ const clientId = envConfig.getString('clientId'); const clientSecret = envConfig.getString('clientSecret'); const audience = envConfig.getString('audience'); + const authServerId = envConfig.getString('authServerId'); const customCallbackUrl = envConfig.getOptionalString('callbackUrl'); const callbackUrl = customCallbackUrl || @@ -240,6 +243,7 @@ export const okta = createAuthProviderIntegration({ const provider = new OktaAuthProvider({ audience, + authServerId, clientId, clientSecret, callbackUrl, diff --git a/yarn.lock b/yarn.lock index f06a187ebf..474e2f2370 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2126,6 +2126,15 @@ dependencies: "@date-io/core" "^1.3.13" +"@davidzemon/passport-okta-oauth@^0.0.4-2": + version "0.0.4-2" + resolved "https://registry.npmjs.org/@davidzemon/passport-okta-oauth/-/passport-okta-oauth-0.0.4-2.tgz#67155fa1f591a30e65bb8b1c8a1433280ec515e2" + integrity sha512-RYyDc1w12LbpTfnTzxmVfyyvkVYYPHoH4TIUAozv27TY1VgY/QEpla2G7fidXDFlu/6itsK0s678s2idd2jhhg== + dependencies: + passport-oauth "^1.0.0" + pkginfo "^0.4.1" + uid2 "^1.0.0" + "@elastic/elasticsearch-mock@^1.0.0": version "1.0.0" resolved "https://registry.npmjs.org/@elastic/elasticsearch-mock/-/elasticsearch-mock-1.0.0.tgz#1fbaf6bf220cd74a34494ff3a8673551d9dfc66f" @@ -20349,7 +20358,7 @@ passport-oauth2@1.6.1, passport-oauth2@1.x.x, passport-oauth2@^1.1.2, passport-o uid2 "0.0.x" utils-merge "1.x.x" -passport-oauth@1.0.0: +passport-oauth@1.0.0, passport-oauth@^1.0.0: version "1.0.0" resolved "https://registry.npmjs.org/passport-oauth/-/passport-oauth-1.0.0.tgz#90aff63387540f02089af28cdad39ea7f80d77df" integrity sha1-kK/2M4dUDwIImvKM2tOep/gNd98= @@ -20357,15 +20366,6 @@ passport-oauth@1.0.0: passport-oauth1 "1.x.x" passport-oauth2 "1.x.x" -passport-okta-oauth@^0.0.1: - version "0.0.1" - resolved "https://registry.npmjs.org/passport-okta-oauth/-/passport-okta-oauth-0.0.1.tgz#c8bcee02af3d56ca79d3cca776f2df7cf15a5748" - integrity sha1-yLzuAq89Vsp508yndvLffPFaV0g= - dependencies: - passport-oauth "1.0.0" - pkginfo "0.2.x" - uid2 "0.0.3" - passport-onelogin-oauth@^0.0.1: version "0.0.1" resolved "https://registry.npmjs.org/passport-onelogin-oauth/-/passport-onelogin-oauth-0.0.1.tgz#6e991ac6720783fdd80d4caa08c36cc71ef19962" @@ -20760,7 +20760,7 @@ pkginfo@0.2.x: resolved "https://registry.npmjs.org/pkginfo/-/pkginfo-0.2.3.tgz#7239c42a5ef6c30b8f328439d9b9ff71042490f8" integrity sha1-cjnEKl72wwuPMoQ52bn/cQQkkPg= -pkginfo@0.4.x: +pkginfo@0.4.x, pkginfo@^0.4.1: version "0.4.1" resolved "https://registry.npmjs.org/pkginfo/-/pkginfo-0.4.1.tgz#b5418ef0439de5425fc4995042dced14fb2a84ff" integrity sha1-tUGO8EOd5UJfxJlQQtztFPsqhP8= @@ -25269,6 +25269,11 @@ uid2@0.0.3, uid2@0.0.x: resolved "https://registry.npmjs.org/uid2/-/uid2-0.0.3.tgz#483126e11774df2f71b8b639dcd799c376162b82" integrity sha1-SDEm4Rd03y9xuLY53NeZw3YWK4I= +uid2@^1.0.0: + version "1.0.0" + resolved "https://registry.npmjs.org/uid2/-/uid2-1.0.0.tgz#ef8d95a128d7c5c44defa1a3d052eecc17a06bfb" + integrity sha512-+I6aJUv63YAcY9n4mQreLUt0d4lvwkkopDNmpomkAUz0fAkEMV9pRWxN0EjhW1YfRhcuyHg2v3mwddCDW1+LFQ== + unbox-primitive@^1.0.1, unbox-primitive@^1.0.2: version "1.0.2" resolved "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.2.tgz#29032021057d5e6cdbd08c5129c226dff8ed6f9e" From 3e154238970fd946fe830255e4b8fc0fd02d5165 Mon Sep 17 00:00:00 2001 From: David Zemon Date: Thu, 30 Jun 2022 09:48:49 -0500 Subject: [PATCH 2/8] docs: [#12248] Document new configuration options Signed-off-by: David Zemon --- docs/auth/okta/provider.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/auth/okta/provider.md b/docs/auth/okta/provider.md index 35394094f8..e4fc8bfb45 100644 --- a/docs/auth/okta/provider.md +++ b/docs/auth/okta/provider.md @@ -41,6 +41,8 @@ auth: clientId: ${AUTH_OKTA_CLIENT_ID} clientSecret: ${AUTH_OKTA_CLIENT_SECRET} audience: ${AUTH_OKTA_DOMAIN} + authServerId: ${AUTH_OKTA_AUTH_SERVER_ID} # Optional + idp: ${AUTH_OKTA_IDP} # Optional ``` The values referenced are found on the Application page on your Okta site. @@ -48,8 +50,10 @@ The values referenced are found on the Application page on your Okta site. - `clientId`: The client ID that you generated on Okta, e.g. `3abe134ejxzF21HU74c1` - `clientSecret`: The client secret shown for the Application. -- `audience`: The Okta domain shown for your Application, e.g. +- `audience`: The Okta domain shown for the Application, e.g. `https://company.okta.com` +- `authServerId`: The authorization server ID for the Application +- `idp`: The identity provider for the application, e.g. `0oaulob4BFVa4zQvt0g3` ## Adding the provider to the Backstage frontend From 3a014730dc6d20431fc8bd992d5668d0b558ebd2 Mon Sep 17 00:00:00 2001 From: David Zemon Date: Thu, 30 Jun 2022 09:54:17 -0500 Subject: [PATCH 3/8] docs: [#12248] Add changeset Signed-off-by: David Zemon --- .changeset/spicy-walls-repair.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/spicy-walls-repair.md diff --git a/.changeset/spicy-walls-repair.md b/.changeset/spicy-walls-repair.md new file mode 100644 index 0000000000..26a84be044 --- /dev/null +++ b/.changeset/spicy-walls-repair.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': minor +--- + +Add new config option for okta auth server and IDP From a5a78be5b8ff41dfb9a167d31e15982c23726826 Mon Sep 17 00:00:00 2001 From: David Zemon Date: Thu, 30 Jun 2022 10:12:15 -0500 Subject: [PATCH 4/8] fix: [#12248] Fix bad import Signed-off-by: David Zemon --- plugins/auth-backend/src/providers/okta/provider.ts | 2 +- plugins/auth-backend/src/providers/okta/types.d.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index b11df1291e..5ee7a1b5c0 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -26,7 +26,7 @@ import { OAuthRefreshRequest, OAuthResult, } from '../../lib/oauth'; -import { Strategy as OktaStrategy } from 'passport-okta-oauth'; +import { Strategy as OktaStrategy } from '@davidzemon/passport-okta-oauth'; import passport from 'passport'; import { executeFrameHandlerStrategy, diff --git a/plugins/auth-backend/src/providers/okta/types.d.ts b/plugins/auth-backend/src/providers/okta/types.d.ts index ab83bf89ec..09ba3e5a7b 100644 --- a/plugins/auth-backend/src/providers/okta/types.d.ts +++ b/plugins/auth-backend/src/providers/okta/types.d.ts @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -declare module 'passport-okta-oauth' { +declare module '@davidzemon/passport-okta-oauth' { export class Strategy { constructor(options: any, verify: any); } From 4443a5e9bebfaa8c597ab7c424b451ceadfd1a0b Mon Sep 17 00:00:00 2001 From: David Zemon Date: Thu, 30 Jun 2022 10:34:51 -0500 Subject: [PATCH 5/8] fix: [#12248] Okta's auth server ID is optional, not required Signed-off-by: David Zemon --- plugins/auth-backend/src/providers/okta/provider.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 5ee7a1b5c0..c050f7a428 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -222,7 +222,7 @@ export const okta = createAuthProviderIntegration({ const clientId = envConfig.getString('clientId'); const clientSecret = envConfig.getString('clientSecret'); const audience = envConfig.getString('audience'); - const authServerId = envConfig.getString('authServerId'); + const authServerId = envConfig.getOptionalString('authServerId'); const customCallbackUrl = envConfig.getOptionalString('callbackUrl'); const callbackUrl = customCallbackUrl || From 777bddd123e9bc2135ba1006fb230825a665531a Mon Sep 17 00:00:00 2001 From: David Zemon Date: Thu, 30 Jun 2022 10:35:21 -0500 Subject: [PATCH 6/8] feat: [#12248] Add Okta IDP option Signed-off-by: David Zemon --- plugins/auth-backend/src/providers/okta/provider.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index c050f7a428..cb686f17e9 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -56,6 +56,7 @@ type PrivateInfo = { export type OktaAuthProviderOptions = OAuthProviderOptions & { audience: string; authServerId?: string; + idp?: string; signInResolver?: SignInResolver; authHandler: AuthHandler; resolverContext: AuthResolverContext; @@ -96,6 +97,7 @@ export class OktaAuthProvider implements OAuthHandlers { callbackURL: options.callbackUrl, audience: options.audience, authServerID: options.authServerId, + idp: options.idp, passReqToCallback: false, store: this.store, response_type: 'code', @@ -223,6 +225,7 @@ export const okta = createAuthProviderIntegration({ const clientSecret = envConfig.getString('clientSecret'); const audience = envConfig.getString('audience'); const authServerId = envConfig.getOptionalString('authServerId'); + const idp = envConfig.getOptionalString('idp'); const customCallbackUrl = envConfig.getOptionalString('callbackUrl'); const callbackUrl = customCallbackUrl || @@ -244,6 +247,7 @@ export const okta = createAuthProviderIntegration({ const provider = new OktaAuthProvider({ audience, authServerId, + idp, clientId, clientSecret, callbackUrl, From 58005b8bcdb407b5c92043ee5e0dcefa09d11033 Mon Sep 17 00:00:00 2001 From: David Zemon Date: Wed, 6 Jul 2022 12:08:16 -0500 Subject: [PATCH 7/8] feat: [#12248] Update to latest @davidzemon/passport-oauth-okta Signed-off-by: David Zemon --- .changeset/spicy-walls-repair.md | 2 +- plugins/auth-backend/package.json | 2 +- .../src/providers/okta/types.d.ts | 20 ----------------- yarn.lock | 22 ++++++++++++++----- 4 files changed, 18 insertions(+), 28 deletions(-) delete mode 100644 plugins/auth-backend/src/providers/okta/types.d.ts diff --git a/.changeset/spicy-walls-repair.md b/.changeset/spicy-walls-repair.md index 26a84be044..36187600c7 100644 --- a/.changeset/spicy-walls-repair.md +++ b/.changeset/spicy-walls-repair.md @@ -1,5 +1,5 @@ --- -'@backstage/plugin-auth-backend': minor +'@backstage/plugin-auth-backend': patch --- Add new config option for okta auth server and IDP diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index 5ef20a1ccf..949a6a0f42 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -40,7 +40,7 @@ "@backstage/config": "^1.0.1", "@backstage/errors": "^1.1.0-next.0", "@backstage/types": "^1.0.0", - "@davidzemon/passport-okta-oauth": "^0.0.4-2", + "@davidzemon/passport-okta-oauth": "^0.0.4", "@google-cloud/firestore": "^5.0.2", "@types/express": "^4.17.6", "@types/passport": "^1.0.3", diff --git a/plugins/auth-backend/src/providers/okta/types.d.ts b/plugins/auth-backend/src/providers/okta/types.d.ts deleted file mode 100644 index 09ba3e5a7b..0000000000 --- a/plugins/auth-backend/src/providers/okta/types.d.ts +++ /dev/null @@ -1,20 +0,0 @@ -/* - * Copyright 2020 The Backstage Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -declare module '@davidzemon/passport-okta-oauth' { - export class Strategy { - constructor(options: any, verify: any); - } -} diff --git a/yarn.lock b/yarn.lock index 474e2f2370..398c9b978c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2126,12 +2126,13 @@ dependencies: "@date-io/core" "^1.3.13" -"@davidzemon/passport-okta-oauth@^0.0.4-2": - version "0.0.4-2" - resolved "https://registry.npmjs.org/@davidzemon/passport-okta-oauth/-/passport-okta-oauth-0.0.4-2.tgz#67155fa1f591a30e65bb8b1c8a1433280ec515e2" - integrity sha512-RYyDc1w12LbpTfnTzxmVfyyvkVYYPHoH4TIUAozv27TY1VgY/QEpla2G7fidXDFlu/6itsK0s678s2idd2jhhg== +"@davidzemon/passport-okta-oauth@^0.0.4": + version "0.0.4" + resolved "https://registry.npmjs.org/@davidzemon/passport-okta-oauth/-/passport-okta-oauth-0.0.4.tgz#25cfdb8f4abee1038449d4c62ada9566b286b55d" + integrity sha512-LYGDtnYnmAvBDpSfdjzq0Ip6VJRlt3vRPECGrJDT6CQHNlt34UpeqQDvDSPPplSUmZkxJcS+mQk++l4Kqxkzaw== dependencies: - passport-oauth "^1.0.0" + "@types/passport-oauth2" "^1.4.11" + passport-oauth2 "^1.6.1" pkginfo "^0.4.1" uid2 "^1.0.0" @@ -6815,6 +6816,15 @@ "@types/oauth" "*" "@types/passport" "*" +"@types/passport-oauth2@^1.4.11": + version "1.4.11" + resolved "https://registry.npmjs.org/@types/passport-oauth2/-/passport-oauth2-1.4.11.tgz#fbca527ecb44258774d17bcb251630c321515fa9" + integrity sha512-KUNwmGhe/3xPbjkzkPwwcPmyFwfyiSgtV1qOrPBLaU4i4q9GSCdAOyCbkFG0gUxAyEmYwqo9OAF/rjPjJ6ImdA== + dependencies: + "@types/express" "*" + "@types/oauth" "*" + "@types/passport" "*" + "@types/passport-saml@^1.1.3": version "1.1.3" resolved "https://registry.npmjs.org/@types/passport-saml/-/passport-saml-1.1.3.tgz#efc57902a07ebe1ec114d00acd8d990e873813a1" @@ -20358,7 +20368,7 @@ passport-oauth2@1.6.1, passport-oauth2@1.x.x, passport-oauth2@^1.1.2, passport-o uid2 "0.0.x" utils-merge "1.x.x" -passport-oauth@1.0.0, passport-oauth@^1.0.0: +passport-oauth@1.0.0: version "1.0.0" resolved "https://registry.npmjs.org/passport-oauth/-/passport-oauth-1.0.0.tgz#90aff63387540f02089af28cdad39ea7f80d77df" integrity sha1-kK/2M4dUDwIImvKM2tOep/gNd98= From 8449c328e31ac7b0f6b8ae43d292e6b6a7d798e7 Mon Sep 17 00:00:00 2001 From: David Zemon Date: Wed, 6 Jul 2022 15:36:12 -0500 Subject: [PATCH 8/8] fix: [#12248] Use fixed version of @davidzemon/passport-oauth-okta Signed-off-by: David Zemon --- plugins/auth-backend/package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json index 949a6a0f42..b1c2f39e27 100644 --- a/plugins/auth-backend/package.json +++ b/plugins/auth-backend/package.json @@ -40,7 +40,7 @@ "@backstage/config": "^1.0.1", "@backstage/errors": "^1.1.0-next.0", "@backstage/types": "^1.0.0", - "@davidzemon/passport-okta-oauth": "^0.0.4", + "@davidzemon/passport-okta-oauth": "^0.0.5", "@google-cloud/firestore": "^5.0.2", "@types/express": "^4.17.6", "@types/passport": "^1.0.3", diff --git a/yarn.lock b/yarn.lock index 398c9b978c..5b8110ec78 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2126,10 +2126,10 @@ dependencies: "@date-io/core" "^1.3.13" -"@davidzemon/passport-okta-oauth@^0.0.4": - version "0.0.4" - resolved "https://registry.npmjs.org/@davidzemon/passport-okta-oauth/-/passport-okta-oauth-0.0.4.tgz#25cfdb8f4abee1038449d4c62ada9566b286b55d" - integrity sha512-LYGDtnYnmAvBDpSfdjzq0Ip6VJRlt3vRPECGrJDT6CQHNlt34UpeqQDvDSPPplSUmZkxJcS+mQk++l4Kqxkzaw== +"@davidzemon/passport-okta-oauth@^0.0.5": + version "0.0.5" + resolved "https://registry.npmjs.org/@davidzemon/passport-okta-oauth/-/passport-okta-oauth-0.0.5.tgz#905d14521f4e8b422f4074c1f7fe1cbe0c88e44b" + integrity sha512-eaC2Ve2MIoqR7dLKgpHxhVKRcfgJCes0Fozxm5SefZh/zqLNb8tGIou+dj0EbylksLmB+nVlhr8p8qwjA9n2sA== dependencies: "@types/passport-oauth2" "^1.4.11" passport-oauth2 "^1.6.1"