From f8b652614e0965a6dd5fd90bca6e66a7e05c0297 Mon Sep 17 00:00:00 2001 From: Jonah Back Date: Tue, 26 Jan 2021 10:50:12 -0800 Subject: [PATCH 1/4] fix: change issuer to iss to conform to JWT spec. Make issuer verification optional --- plugins/auth-backend/src/providers/aws-alb/provider.ts | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.ts b/plugins/auth-backend/src/providers/aws-alb/provider.ts index 41dc5cf916..a5db2869b5 100644 --- a/plugins/auth-backend/src/providers/aws-alb/provider.ts +++ b/plugins/auth-backend/src/providers/aws-alb/provider.ts @@ -34,7 +34,7 @@ const ALB_JWT_HEADER = 'x-amzn-oidc-data'; */ type AwsAlbAuthProviderOptions = { region: string; - issuer: string; + issuer?: string; identityResolutionCallback: ExperimentalIdentityResolver; }; export const getJWTHeaders = (input: string) => { @@ -70,10 +70,7 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers { const key = await this.getKey(headers.kid); const payload = JWT.verify(jwt, key); - if ( - this.options.issuer !== '' && - headers.issuer !== this.options.issuer - ) { + if (this.options.issuer && headers.iss !== this.options.issuer) { throw new Error('issuer mismatch on JWT'); } @@ -116,7 +113,7 @@ export const createAwsAlbProvider = ({ identityResolver, }: AuthProviderFactoryOptions) => { const region = config.getString('region'); - const issuer = config.getString('iss'); + const issuer = config.getOptionalString('iss'); if (identityResolver !== undefined) { return new AwsAlbAuthProvider(logger, catalogApi, { region, From 4eaa060572b7c5285dfa426c201fc03e3760a347 Mon Sep 17 00:00:00 2001 From: Jonah Back Date: Tue, 26 Jan 2021 10:54:14 -0800 Subject: [PATCH 2/4] Fix test, add changeset for ALB provider bug fix --- .changeset/stale-tools-confess.md | 5 +++++ plugins/auth-backend/src/providers/aws-alb/provider.test.ts | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .changeset/stale-tools-confess.md diff --git a/.changeset/stale-tools-confess.md b/.changeset/stale-tools-confess.md new file mode 100644 index 0000000000..f5e6a6da02 --- /dev/null +++ b/.changeset/stale-tools-confess.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Fix issuer check diff --git a/plugins/auth-backend/src/providers/aws-alb/provider.test.ts b/plugins/auth-backend/src/providers/aws-alb/provider.test.ts index bae809971e..d05b6bbfaf 100644 --- a/plugins/auth-backend/src/providers/aws-alb/provider.test.ts +++ b/plugins/auth-backend/src/providers/aws-alb/provider.test.ts @@ -80,7 +80,7 @@ describe('AwsALBAuthProvider', () => { const mockResponseSend = jest.fn(); const mockRequest = ({ header: jest.fn(() => { - return 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyIsImlzc3VlciI6ImZvbyJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.zUkMYAuMwC1T0tyHMpxXrkbFDa4aGhB8d9um_tI2hsI'; + return 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImZvbyIsImlzcyI6ImZvbyJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.T2BNS4G-6RoiFnXc8Q8TiwdWzTpNitY8jcsGM3N3-Yo'; }), } as unknown) as express.Request; const mockRequestWithoutJwt = ({ From da8b9ef1d8d2c961e1a50cc181028f24c96499c0 Mon Sep 17 00:00:00 2001 From: Jonah Back Date: Tue, 26 Jan 2021 11:41:41 -0800 Subject: [PATCH 3/4] add fields to config type for aws-alb provider --- plugins/auth-backend/config.d.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts index c748090711..84f71b52b9 100644 --- a/plugins/auth-backend/config.d.ts +++ b/plugins/auth-backend/config.d.ts @@ -72,6 +72,10 @@ export interface Config { onelogin?: { development: { [key: string]: string }; }; + awsalb?: { + issuer?: string; + region: string; + }; }; }; } From f50d284fb8373cf59f0de59d40e9c1b99089e7e1 Mon Sep 17 00:00:00 2001 From: Jonah Back Date: Tue, 26 Jan 2021 13:27:59 -0800 Subject: [PATCH 4/4] Update .changeset/stale-tools-confess.md Co-authored-by: Patrik Oldsberg --- .changeset/stale-tools-confess.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/stale-tools-confess.md b/.changeset/stale-tools-confess.md index f5e6a6da02..10f2203010 100644 --- a/.changeset/stale-tools-confess.md +++ b/.changeset/stale-tools-confess.md @@ -2,4 +2,4 @@ '@backstage/plugin-auth-backend': patch --- -Fix issuer check +Fix AWS ALB issuer check