Merge pull request #4266 from backjo/fix/AlbIssuerCheck

fix: change issuer to iss to conform to JWT spec. Make issuer verification optional

.changeset/stale-tools-confess.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fix AWS ALB issuer check

plugins/auth-backend/config.d.ts

@@ -72,6 +72,10 @@ export interface Config {
       onelogin?: {
         development: { [key: string]: string };
       };
+      awsalb?: {
+        issuer?: string;
+        region: string;
+      };
     };
   };
 }

plugins/auth-backend/src/providers/aws-alb/provider.test.ts

@@ -80,7 +80,7 @@ describe('AwsALBAuthProvider', () => {
   const mockResponseSend = jest.fn();
   const mockRequest = ({
     header: jest.fn(() => {
-      return 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyIsImlzc3VlciI6ImZvbyJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.zUkMYAuMwC1T0tyHMpxXrkbFDa4aGhB8d9um_tI2hsI';
+      return 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyIsImlzcyI6ImZvbyJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.T2BNS4G-6RoiFnXc8Q8TiwdWzTpNitY8jcsGM3N3-Yo';
     }),
   } as unknown) as express.Request;
   const mockRequestWithoutJwt = ({

plugins/auth-backend/src/providers/aws-alb/provider.ts

@@ -34,7 +34,7 @@ const ALB_JWT_HEADER = 'x-amzn-oidc-data';
  */
 type AwsAlbAuthProviderOptions = {
   region: string;
-  issuer: string;
+  issuer?: string;
   identityResolutionCallback: ExperimentalIdentityResolver;
 };
 export const getJWTHeaders = (input: string) => {
@@ -70,10 +70,7 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
         const key = await this.getKey(headers.kid);
         const payload = JWT.verify(jwt, key);
 
-        if (
-          this.options.issuer !== '' &&
-          headers.issuer !== this.options.issuer
-        ) {
+        if (this.options.issuer && headers.iss !== this.options.issuer) {
           throw new Error('issuer mismatch on JWT');
         }
 
@@ -116,7 +113,7 @@ export const createAwsAlbProvider = ({
   identityResolver,
 }: AuthProviderFactoryOptions) => {
   const region = config.getString('region');
-  const issuer = config.getString('iss');
+  const issuer = config.getOptionalString('iss');
   if (identityResolver !== undefined) {
     return new AwsAlbAuthProvider(logger, catalogApi, {
       region,