paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases Wiki Activity

chore: add oauth2 proxy provider backend module

Browse Source 
Signed-off-by: djamaile <rdjamaile@gmail.com>
This commit is contained in:
djamaile
2023-10-12 15:05:03 +02:00
parent 4a11189089
commit d3b4b632dd
10 changed files with 238 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/backend/package.json
+1
View File
@@ -35,6 +35,7 @@
"@backstage/plugin-adr-backend": "workspace:^",
"@backstage/plugin-app-backend": "workspace:^",
"@backstage/plugin-auth-backend": "workspace:^",
"@backstage/plugin-auth-backend-module-oauth2-proxy-provider": "^0.0.0",
"@backstage/plugin-auth-node": "workspace:^",
"@backstage/plugin-azure-devops-backend": "workspace:^",
"@backstage/plugin-azure-sites-backend": "workspace:^",
plugins/auth-backend-module-oauth2-proxy-provider/.eslintrc.js
+1
View File
@@ -0,0 +1 @@
module.exports = require('@backstage/cli/config/eslint-factory')(__dirname);
plugins/auth-backend-module-oauth2-proxy-provider/README.md
+5
View File
@@ -0,0 +1,5 @@
# @backstage/plugin-auth-backend-module-oauth2-proxy-provider
The oauth2-proxy-provider backend module for the auth plugin.
_This plugin was created through the Backstage CLI_
plugins/auth-backend-module-oauth2-proxy-provider/package.json
+40
View File
@@ -0,0 +1,40 @@
{
"name": "@backstage/plugin-auth-backend-module-oauth2-proxy-provider",
"description": "The oauth2-proxy-provider backend module for the auth plugin.",
"version": "0.0.0",
"main": "src/index.ts",
"types": "src/index.ts",
"license": "Apache-2.0",
"publishConfig": {
"access": "public",
"main": "dist/index.cjs.js",
"types": "dist/index.d.ts"
},
"backstage": {
"role": "backend-plugin-module"
},
"scripts": {
"start": "backstage-cli package start",
"build": "backstage-cli package build",
"lint": "backstage-cli package lint",
"test": "backstage-cli package test",
"clean": "backstage-cli package clean",
"prepack": "backstage-cli package prepack",
"postpack": "backstage-cli package postpack"
},
"dependencies": {
"@backstage/backend-common": "workspace:^",
"@backstage/backend-plugin-api": "workspace:^",
"@backstage/errors": "workspace:^",
"@backstage/plugin-auth-backend": "workspace:^",
"@backstage/plugin-auth-node": "workspace:^",
"jose": "^4.6.0"
},
"devDependencies": {
"@backstage/backend-test-utils": "workspace:^",
"@backstage/cli": "workspace:^"
},
"files": [
"dist"
]
}
plugins/auth-backend-module-oauth2-proxy-provider/src/authenticator.ts
+62
View File
@@ -0,0 +1,62 @@
/*
* Copyright 2023 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { AuthenticationError } from '@backstage/errors';
import { OAuth2ProxyResult } from '@backstage/plugin-auth-backend';
import {
createProxyAuthenticator,
getBearerTokenFromAuthorizationHeader,
} from '@backstage/plugin-auth-node';
import { decodeJwt } from 'jose';
// NOTE: This may come in handy if you're doing work on this provider:
// plugins/auth-backend/examples/docker-compose.oauth2-proxy.yaml
export const OAUTH2_PROXY_JWT_HEADER = 'X-OAUTH2-PROXY-ID-TOKEN';
export const oauth2ProxyAuthenticator = createProxyAuthenticator({
defaultProfileTransform: async (result: OAuth2ProxyResult) => {
return {
profile: {
email: result.getHeader('x-forwarded-email'),
displayName:
result.getHeader('x-forwarded-preferred-username') ||
result.getHeader('x-forwarded-user'),
},
};
},
async authenticate({ req }) {
try {
const authHeader = req.header(OAUTH2_PROXY_JWT_HEADER);
const jwt = getBearerTokenFromAuthorizationHeader(authHeader);
const decodedJWT = jwt && decodeJwt(jwt);
const result = {
fullProfile: decodedJWT || {},
accessToken: jwt || '',
headers: req.headers,
getHeader(name: string) {
if (name.toLocaleLowerCase('en-US') === 'set-cookie') {
throw new Error('Access Set-Cookie via the headers object instead');
}
return req.get(name);
},
};
return { result };
} catch (e) {
throw new AuthenticationError('Authentication failed', e);
}
},
});
plugins/auth-backend-module-oauth2-proxy-provider/src/index.ts
+22
View File
@@ -0,0 +1,22 @@
/*
* Copyright 2023 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/**
* The oauth2-proxy-provider backend module for the auth plugin.
*
* @packageDocumentation
*/
export { authModuleOauth2ProxyProvider } from './module';
plugins/auth-backend-module-oauth2-proxy-provider/src/module.ts
+49
View File
@@ -0,0 +1,49 @@
/*
* Copyright 2023 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { createBackendModule } from '@backstage/backend-plugin-api';
import {
authProvidersExtensionPoint,
createProxyAuthProviderFactory,
commonSignInResolvers,
} from '@backstage/plugin-auth-node';
import { oauth2ProxyAuthenticator } from './authenticator';
import { oauth2ProxySignInResolvers } from './resolvers';
/** @public */
export const authModuleOauth2ProxyProvider = createBackendModule({
pluginId: 'auth',
moduleId: 'oauth2ProxyProvider',
register(reg) {
reg.registerInit({
deps: {
providers: authProvidersExtensionPoint,
},
async init({ providers }) {
providers.registerProvider({
providerId: 'oauth2ProxyProvider',
factory: createProxyAuthProviderFactory({
authenticator: oauth2ProxyAuthenticator,
signInResolverFactories: {
...commonSignInResolvers,
...oauth2ProxySignInResolvers,
},
}),
});
},
});
},
});
plugins/auth-backend-module-oauth2-proxy-provider/src/resolvers.ts
+41
View File
@@ -0,0 +1,41 @@
/*
* Copyright 2023 The Backstage Authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import {
createSignInResolverFactory,
SignInInfo,
} from '@backstage/plugin-auth-node';
import { OAuth2ProxyResult } from '@backstage/plugin-auth-backend';
/**
* @public
*/
export namespace oauth2ProxySignInResolvers {
export const forwardedUserMarchingUserEntityName =
createSignInResolverFactory({
create() {
return async (info: SignInInfo<OAuth2ProxyResult>, ctx) => {
const name = info.result.getHeader('x-forwarded-user');
if (!name) {
throw new Error('Request did not contain a user');
}
return ctx.signInWithCatalogUser({
entityRef: { name },
});
};
},
});
}
plugins/auth-node/src/proxy/types.ts
+1 -1
View File
@@ -21,7 +21,7 @@ import { ProfileTransform } from '../types';
/** @public */
export interface ProxyAuthenticator<TContext, TResult> {
defaultProfileTransform: ProfileTransform<TResult>;
initialize(ctx: { config: Config }): TContext;
initialize?(ctx: { config: Config }): TContext;
authenticate(
options: { req: Request },
ctx: TContext,
yarn.lock
+16
View File
@@ -4672,6 +4672,21 @@ __metadata:
languageName: unknown
linkType: soft
"@backstage/plugin-auth-backend-module-oauth2-proxy-provider@^0.0.0, @backstage/plugin-auth-backend-module-oauth2-proxy-provider@workspace:plugins/auth-backend-module-oauth2-proxy-provider":
version: 0.0.0-use.local
resolution: "@backstage/plugin-auth-backend-module-oauth2-proxy-provider@workspace:plugins/auth-backend-module-oauth2-proxy-provider"
dependencies:
"@backstage/backend-common": "workspace:^"
"@backstage/backend-plugin-api": "workspace:^"
"@backstage/backend-test-utils": "workspace:^"
"@backstage/cli": "workspace:^"
"@backstage/errors": "workspace:^"
"@backstage/plugin-auth-backend": "workspace:^"
"@backstage/plugin-auth-node": "workspace:^"
jose: ^4.6.0
languageName: unknown
linkType: soft
"@backstage/plugin-auth-backend-module-okta-provider@workspace:^, @backstage/plugin-auth-backend-module-okta-provider@workspace:plugins/auth-backend-module-okta-provider":
version: 0.0.0-use.local
resolution: "@backstage/plugin-auth-backend-module-okta-provider@workspace:plugins/auth-backend-module-okta-provider"
@@ -26327,6 +26342,7 @@ __metadata:
"@backstage/plugin-adr-backend": "workspace:^"
"@backstage/plugin-app-backend": "workspace:^"
"@backstage/plugin-auth-backend": "workspace:^"
"@backstage/plugin-auth-backend-module-oauth2-proxy-provider": ^0.0.0
"@backstage/plugin-auth-node": "workspace:^"
"@backstage/plugin-azure-devops-backend": "workspace:^"
"@backstage/plugin-azure-sites-backend": "workspace:^"