Merge pull request #12359 from DavidZemon/feature/fix-okta-oauth

feat: [#12248] Switch to new okta strategy

plugins/auth-backend/package.json

@@ -40,6 +40,7 @@
     "@backstage/config": "^1.0.1",
     "@backstage/errors": "^1.1.0-next.0",
     "@backstage/types": "^1.0.0",
+    "@davidzemon/passport-okta-oauth": "^0.0.5",
     "@google-cloud/firestore": "^5.0.2",
     "@types/express": "^4.17.6",
     "@types/passport": "^1.0.3",
@@ -68,7 +69,6 @@
     "passport-google-oauth20": "^2.0.0",
     "passport-microsoft": "^1.0.0",
     "passport-oauth2": "^1.6.1",
-    "passport-okta-oauth": "^0.0.1",
     "passport-onelogin-oauth": "^0.0.1",
     "passport-saml": "^3.1.2",
     "uuid": "^8.0.0",

plugins/auth-backend/src/providers/okta/provider.ts

@@ -26,7 +26,7 @@ import {
   OAuthRefreshRequest,
   OAuthResult,
 } from '../../lib/oauth';
-import { Strategy as OktaStrategy } from 'passport-okta-oauth';
+import { Strategy as OktaStrategy } from '@davidzemon/passport-okta-oauth';
 import passport from 'passport';
 import {
   executeFrameHandlerStrategy,
@@ -55,6 +55,8 @@ type PrivateInfo = {
 
 export type OktaAuthProviderOptions = OAuthProviderOptions & {
   audience: string;
+  authServerId?: string;
+  idp?: string;
   signInResolver?: SignInResolver<OAuthResult>;
   authHandler: AuthHandler<OAuthResult>;
   resolverContext: AuthResolverContext;
@@ -94,6 +96,8 @@ export class OktaAuthProvider implements OAuthHandlers {
         clientSecret: options.clientSecret,
         callbackURL: options.callbackUrl,
         audience: options.audience,
+        authServerID: options.authServerId,
+        idp: options.idp,
         passReqToCallback: false,
         store: this.store,
         response_type: 'code',
@@ -220,6 +224,8 @@ export const okta = createAuthProviderIntegration({
         const clientId = envConfig.getString('clientId');
         const clientSecret = envConfig.getString('clientSecret');
         const audience = envConfig.getString('audience');
+        const authServerId = envConfig.getOptionalString('authServerId');
+        const idp = envConfig.getOptionalString('idp');
         const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
         const callbackUrl =
           customCallbackUrl ||
@@ -240,6 +246,8 @@ export const okta = createAuthProviderIntegration({
 
         const provider = new OktaAuthProvider({
           audience,
+          authServerId,
+          idp,
           clientId,
           clientSecret,
           callbackUrl,

plugins/auth-backend/src/providers/okta/types.d.ts

@@ -1,20 +0,0 @@
-/*
- * Copyright 2020 The Backstage Authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-declare module 'passport-okta-oauth' {
-  export class Strategy {
-    constructor(options: any, verify: any);
-  }
-}