paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 40 Packages Projects Releases Wiki Activity

upstream master

Browse Source
This commit is contained in:
NHI TRAN
2021-02-21 13:21:37 -05:00
parent f43192207a 1add977bae
commit e6fe13c675
711 changed files with 28616 additions and 8710 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-backend/src/identity/DatabaseKeyStore.test.ts
+6 -2
View File
@@ -15,8 +15,8 @@
*/
import Knex from 'knex';
import moment from 'moment';
import { DatabaseKeyStore } from './DatabaseKeyStore';
import { DateTime } from 'luxon';
function createDB() {
const knex = Knex({
@@ -51,7 +51,11 @@ describe('DatabaseKeyStore', () => {
const { items } = await store.listKeys();
expect(items).toEqual([{ createdAt: expect.anything(), key }]);
expect(Math.abs(items[0].createdAt.diff(moment(), 's'))).toBeLessThan(10);
expect(
Math.abs(
DateTime.fromJSDate(items[0].createdAt).diffNow('seconds').seconds,
),
).toBeLessThan(10);
});
it('should remove stored keys', async () => {
plugins/auth-backend/src/identity/DatabaseKeyStore.ts
+18 -3
View File
@@ -15,9 +15,9 @@
*/
import Knex from 'knex';
import { utc } from 'moment';
import { resolvePackagePath } from '@backstage/backend-common';
import { AnyJWK, KeyStore, StoredKey } from './types';
import { DateTime } from 'luxon';
const migrationsDir = resolvePackagePath(
'@backstage/plugin-auth-backend',
@@ -27,7 +27,7 @@ const migrationsDir = resolvePackagePath(
const TABLE = 'signing_keys';
type Row = {
created_at: Date;
created_at: Date; // row.created_at is a string after being returned from the database
kid: string;
key: string;
};
@@ -36,6 +36,21 @@ type Options = {
database: Knex;
};
const parseDate = (date: string | Date) => {
const parsedDate =
typeof date === 'string'
? DateTime.fromSQL(date, { zone: 'UTC' })
: DateTime.fromJSDate(date);
if (!parsedDate.isValid) {
throw new Error(
`Failed to parse date, reason: ${parsedDate.invalidReason}, explanation: ${parsedDate.invalidExplanation}`,
);
}
return parsedDate.toJSDate();
};
export class DatabaseKeyStore implements KeyStore {
static async create(options: Options): Promise<DatabaseKeyStore> {
const { database } = options;
@@ -66,7 +81,7 @@ export class DatabaseKeyStore implements KeyStore {
return {
items: rows.map(row => ({
key: JSON.parse(row.key),
createdAt: utc(row.created_at),
createdAt: parseDate(row.created_at),
})),
};
}
plugins/auth-backend/src/identity/MemoryKeyStore.ts
+3 -6
View File
@@ -14,18 +14,15 @@
* limitations under the License.
*/
import { utc } from 'moment';
import { KeyStore, AnyJWK, StoredKey } from './types';
import { DateTime } from 'luxon';
export class MemoryKeyStore implements KeyStore {
private readonly keys = new Map<
string,
{ createdAt: moment.Moment; key: string }
>();
private readonly keys = new Map<string, { createdAt: Date; key: string }>();
async addKey(key: AnyJWK): Promise<void> {
this.keys.set(key.kid, {
createdAt: utc(),
createdAt: DateTime.utc().toJSDate(),
key: JSON.stringify(key),
});
}
plugins/auth-backend/src/identity/TokenFactory.ts
+15 -6
View File
@@ -14,11 +14,11 @@
* limitations under the License.
*/
import moment from 'moment';
import { TokenIssuer, TokenParams, KeyStore, AnyJWK } from './types';
import { JSONWebKey, JWK, JWS } from 'jose';
import { Logger } from 'winston';
import { v4 as uuid } from 'uuid';
import { DateTime } from 'luxon';
const MS_IN_S = 1000;
@@ -52,7 +52,7 @@ export class TokenFactory implements TokenIssuer {
private readonly keyStore: KeyStore;
private readonly keyDurationSeconds: number;
private keyExpiry?: moment.Moment;
private keyExpiry?: Date;
private privateKeyPromise?: Promise<JSONWebKey>;
constructor(options: Options) {
@@ -90,8 +90,10 @@ export class TokenFactory implements TokenIssuer {
for (const key of keys) {
// Allow for a grace period of another full key duration before we remove the keys from the database
const expireAt = key.createdAt.add(3 * this.keyDurationSeconds, 's');
if (expireAt.isBefore()) {
const expireAt = DateTime.fromJSDate(key.createdAt).plus({
seconds: 3 * this.keyDurationSeconds,
});
if (expireAt < DateTime.local()) {
expiredKeys.push(key);
} else {
validKeys.push(key);
@@ -117,14 +119,21 @@ export class TokenFactory implements TokenIssuer {
private async getKey(): Promise<JSONWebKey> {
// Make sure that we only generate one key at a time
if (this.privateKeyPromise) {
if (this.keyExpiry?.isAfter()) {
if (
this.keyExpiry &&
DateTime.fromJSDate(this.keyExpiry) > DateTime.local()
) {
return this.privateKeyPromise;
}
this.logger.info(`Signing key has expired, generating new key`);
delete this.privateKeyPromise;
}
this.keyExpiry = moment().add(this.keyDurationSeconds, 'seconds');
this.keyExpiry = DateTime.utc()
.plus({
seconds: this.keyDurationSeconds,
})
.toJSDate();
const promise = (async () => {
// This generates a new signing key to be used to sign tokens until the next key rotation
const key = await JWK.generate('EC', 'P-256', {
plugins/auth-backend/src/identity/types.ts
+1 -1
View File
@@ -52,7 +52,7 @@ export type TokenIssuer = {
*/
export type StoredKey = {
key: AnyJWK;
createdAt: moment.Moment;
createdAt: Date;
};
/**
plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.test.ts
+8 -5
View File
@@ -38,11 +38,14 @@ describe('CatalogIdentityClient', () => {
client.findUser({ annotations: { key: 'value' } });
expect(catalogApi.getEntities).toBeCalledWith({
filter: {
kind: 'user',
'metadata.annotations.key': 'value',
expect(catalogApi.getEntities).toBeCalledWith(
{
filter: {
kind: 'user',
'metadata.annotations.key': 'value',
},
},
});
undefined,
);
});
});
plugins/auth-backend/src/lib/catalog/CatalogIdentityClient.ts
+5 -2
View File
@@ -37,7 +37,10 @@ export class CatalogIdentityClient {
*
* Throws a NotFoundError or ConflictError if 0 or multiple users are found.
*/
async findUser(query: UserQuery): Promise<UserEntity> {
async findUser(
query: UserQuery,
options?: { token?: string },
): Promise<UserEntity> {
const filter: Record<string, string> = {
kind: 'user',
};
@@ -45,7 +48,7 @@ export class CatalogIdentityClient {
filter[`metadata.annotations.${key}`] = value;
}
const { items } = await this.catalogApi.getEntities({ filter });
const { items } = await this.catalogApi.getEntities({ filter }, options);
if (items.length !== 1) {
if (items.length > 1) {
plugins/auth-backend/src/lib/oauth/index.ts
+1
View File
@@ -25,4 +25,5 @@ export type {
OAuthState,
OAuthStartRequest,
OAuthRefreshRequest,
OAuthResult,
} from './types';
plugins/auth-backend/src/lib/oauth/types.ts
+12
View File
@@ -15,6 +15,7 @@
*/
import express from 'express';
import { Profile as PassportProfile } from 'passport';
import { AuthResponse, RedirectInfo } from '../../providers/types';
/**
@@ -35,6 +36,17 @@ export type OAuthProviderOptions = {
callbackUrl: string;
};
export type OAuthResult = {
fullProfile: PassportProfile;
params: {
id_token?: string;
scope: string;
expires_in: number;
};
accessToken: string;
refreshToken?: string;
};
export type OAuthResponse = AuthResponse<OAuthProviderInfo>;
export type OAuthProviderInfo = {
plugins/auth-backend/src/lib/passport/PassportStrategyHelper.test.ts
+1 -1
View File
@@ -87,7 +87,7 @@ describe('PassportStrategyHelper', () => {
expect(spyAuthenticate).toBeCalledTimes(1);
await expect(frameHandlerStrategyPromise).resolves.toStrictEqual(
expect.objectContaining({
response: { accessToken: 'ACCESS_TOKEN' },
result: { accessToken: 'ACCESS_TOKEN' },
privateInfo: { refreshToken: 'REFRESH_TOKEN' },
}),
);
plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts
+9 -11
View File
@@ -39,7 +39,7 @@ export const makeProfileInfo = (
}
let picture: string | undefined = undefined;
if (profile.photos) {
if (profile.photos && profile.photos.length > 0) {
const [firstPhoto] = profile.photos;
picture = firstPhoto.value;
}
@@ -80,15 +80,15 @@ export const executeRedirectStrategy = async (
});
};
export const executeFrameHandlerStrategy = async <T, PrivateInfo = never>(
export const executeFrameHandlerStrategy = async <Result, PrivateInfo = never>(
req: express.Request,
providerStrategy: passport.Strategy,
) => {
return new Promise<{ response: T; privateInfo: PrivateInfo }>(
return new Promise<{ result: Result; privateInfo: PrivateInfo }>(
(resolve, reject) => {
const strategy = Object.create(providerStrategy);
strategy.success = (response: any, privateInfo: any) => {
resolve({ response, privateInfo });
strategy.success = (result: any, privateInfo: any) => {
resolve({ result, privateInfo });
};
strategy.fail = (
info: { type: 'success' | 'error'; message?: string },
@@ -190,19 +190,17 @@ type ProviderStrategy = {
export const executeFetchUserProfileStrategy = async (
providerStrategy: passport.Strategy,
accessToken: string,
idToken?: string,
): Promise<ProfileInfo> => {
): Promise<passport.Profile> => {
return new Promise((resolve, reject) => {
const anyStrategy = (providerStrategy as unknown) as ProviderStrategy;
anyStrategy.userProfile(
accessToken,
(error: Error, passportProfile: passport.Profile) => {
(error: Error, rawProfile: passport.Profile) => {
if (error) {
reject(error);
} else {
resolve(rawProfile);
}
const profile = makeProfileInfo(passportProfile, idToken);
resolve(profile);
},
);
});
plugins/auth-backend/src/providers/auth0/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createAuth0Provider } from './provider';
export type { Auth0ProviderOptions } from './provider';
plugins/auth-backend/src/providers/auth0/provider.ts
+45 -37
View File
@@ -26,6 +26,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import {
executeFetchUserProfileStrategy,
@@ -61,20 +62,16 @@ export class Auth0AuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
fullProfile,
accessToken,
refreshToken,
params,
},
{
refreshToken,
@@ -96,13 +93,23 @@ export class Auth0AuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -114,11 +121,11 @@ export class Auth0AuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -148,28 +155,29 @@ export class Auth0AuthProvider implements OAuthHandlers {
}
}
export const createAuth0Provider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const domain = envConfig.getString('domain');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type Auth0ProviderOptions = {};
const provider = new Auth0AuthProvider({
clientId,
clientSecret,
callbackUrl,
domain,
});
export const createAuth0Provider = (
_options?: Auth0ProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const domain = envConfig.getString('domain');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
const provider = new Auth0AuthProvider({
clientId,
clientSecret,
callbackUrl,
domain,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/aws-alb/index.ts
+1
View File
@@ -14,3 +14,4 @@
* limitations under the License.
*/
export { createAwsAlbProvider } from './provider';
export type { AwsAlbProviderOptions } from './provider';
plugins/auth-backend/src/providers/aws-alb/provider.ts
+22 -18
View File
@@ -106,22 +106,26 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
}
}
export const createAwsAlbProvider = ({
logger,
catalogApi,
config,
identityResolver,
}: AuthProviderFactoryOptions) => {
const region = config.getString('region');
const issuer = config.getOptionalString('iss');
if (identityResolver !== undefined) {
return new AwsAlbAuthProvider(logger, catalogApi, {
region,
issuer,
identityResolutionCallback: identityResolver,
});
}
throw new Error(
'Identity resolver is required to use this authentication provider',
);
export type AwsAlbProviderOptions = {};
export const createAwsAlbProvider = (_options?: AwsAlbProviderOptions) => {
return ({
logger,
catalogApi,
config,
identityResolver,
}: AuthProviderFactoryOptions) => {
const region = config.getString('region');
const issuer = config.getOptionalString('iss');
if (identityResolver !== undefined) {
return new AwsAlbAuthProvider(logger, catalogApi, {
region,
issuer,
identityResolutionCallback: identityResolver,
});
}
throw new Error(
'Identity resolver is required to use this authentication provider',
);
};
};
plugins/auth-backend/src/providers/factories.ts
+11 -11
View File
@@ -28,15 +28,15 @@ import { AuthProviderFactory } from './types';
import { createAwsAlbProvider } from './aws-alb';
export const factories: { [providerId: string]: AuthProviderFactory } = {
google: createGoogleProvider,
github: createGithubProvider,
gitlab: createGitlabProvider,
saml: createSamlProvider,
okta: createOktaProvider,
auth0: createAuth0Provider,
microsoft: createMicrosoftProvider,
oauth2: createOAuth2Provider,
oidc: createOidcProvider,
onelogin: createOneLoginProvider,
awsalb: createAwsAlbProvider,
google: createGoogleProvider(),
github: createGithubProvider(),
gitlab: createGitlabProvider(),
saml: createSamlProvider(),
okta: createOktaProvider(),
auth0: createAuth0Provider(),
microsoft: createMicrosoftProvider(),
oauth2: createOAuth2Provider(),
oidc: createOidcProvider(),
onelogin: createOneLoginProvider(),
awsalb: createAwsAlbProvider(),
};
plugins/auth-backend/src/providers/github/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createGithubProvider } from './provider';
export type { GithubProviderOptions } from './provider';
plugins/auth-backend/src/providers/github/provider.test.ts
+49 -38
View File
@@ -14,13 +14,31 @@
* limitations under the License.
*/
import { Profile as PassportProfile } from 'passport';
import { GithubAuthProvider } from './provider';
import * as helpers from '../../lib/passport';
import { OAuthResult } from '../../lib/oauth';
const mockFrameHandler = (jest.spyOn(
helpers,
'executeFrameHandlerStrategy',
) as unknown) as jest.MockedFunction<
() => Promise<{
result: Omit<OAuthResult, 'params'> & { params: { scope: string } };
}>
>;
describe('GithubAuthProvider', () => {
const provider = new GithubAuthProvider({
callbackUrl: 'mock',
clientId: 'mock',
clientSecret: 'mock',
});
describe('should transform to type OAuthResponse', () => {
it('when all fields are present, it should be able to map them', () => {
it('when all fields are present, it should be able to map them', async () => {
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
const rawProfile = {
const fullProfile = {
id: 'uid-123',
username: 'jimmymarkum',
provider: 'github',
@@ -59,18 +77,17 @@ describe('GithubAuthProvider', () => {
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
it('when "email" is missing, it should be able to create the profile without it', () => {
it('when "email" is missing, it should be able to create the profile without it', async () => {
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
const rawProfile = {
const fullProfile = ({
id: 'uid-123',
username: 'jimmymarkum',
provider: 'github',
@@ -82,7 +99,7 @@ describe('GithubAuthProvider', () => {
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
],
};
} as unknown) as PassportProfile;
const params = {
scope: 'read:scope',
@@ -105,18 +122,16 @@ describe('GithubAuthProvider', () => {
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
it('when "displayName" is missing, it should be able to create the profile and map "displayName" with "username"', () => {
it('when "displayName" is missing, it should be able to create the profile and map "displayName" with "username"', async () => {
const accessToken = '19xasczxcm9n7gacn9jdgm19me';
const rawProfile = {
const fullProfile = ({
id: 'uid-123',
username: 'jimmymarkum',
provider: 'github',
@@ -128,7 +143,7 @@ describe('GithubAuthProvider', () => {
'https://a1cf74336522e87f135f-2f21ace9a6cf0052456644b80fa06d4f.ssl.cf2.rackcdn.com/images/characters_opt/p-mystic-river-sean-penn.jpg',
},
],
};
} as unknown) as PassportProfile;
const params = {
scope: 'read:scope',
@@ -150,19 +165,17 @@ describe('GithubAuthProvider', () => {
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
it('when "photos" is missing, it should be able to create the profile without it', () => {
it('when "photos" is missing, it should be able to create the profile without it', async () => {
const accessToken =
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe';
const rawProfile = {
const fullProfile = {
id: 'ipd12039',
username: 'daveboyle',
provider: 'gitlab',
@@ -195,13 +208,11 @@ describe('GithubAuthProvider', () => {
},
};
expect(
GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
),
).toEqual(expected);
mockFrameHandler.mockResolvedValueOnce({
result: { fullProfile, accessToken, params },
});
const { response } = await provider.handler({} as any);
expect(response).toEqual(expected);
});
});
});
plugins/auth-backend/src/providers/github/provider.ts
+67 -100
View File
@@ -27,12 +27,11 @@ import {
OAuthAdapter,
OAuthProviderOptions,
OAuthHandlers,
OAuthResponse,
OAuthEnvironmentHandler,
OAuthStartRequest,
encodeState,
OAuthResult,
} from '../../lib/oauth';
import passport from 'passport';
export type GithubAuthProviderOptions = OAuthProviderOptions & {
tokenUrl?: string;
@@ -43,55 +42,6 @@ export type GithubAuthProviderOptions = OAuthProviderOptions & {
export class GithubAuthProvider implements OAuthHandlers {
private readonly _strategy: GithubStrategy;
static transformPassportProfile(rawProfile: any): passport.Profile {
const profile: passport.Profile = {
id: rawProfile.username,
username: rawProfile.username,
provider: rawProfile.provider,
displayName: rawProfile.displayName || rawProfile.username,
photos: rawProfile.photos,
emails: rawProfile.emails,
};
return profile;
}
static transformOAuthResponse(
accessToken: string,
rawProfile: any,
params: any = {},
): OAuthResponse {
const passportProfile = GithubAuthProvider.transformPassportProfile(
rawProfile,
);
const profile = makeProfileInfo(passportProfile, params.id_token);
const providerInfo = {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
idToken: params.id_token,
};
// GitHub provides an id numeric value (123)
// as a fallback
const id = passportProfile!.id;
if (params.expires_in) {
providerInfo.expiresInSeconds = params.expires_in;
}
if (params.id_token) {
providerInfo.idToken = params.id_token;
}
return {
providerInfo,
profile,
backstageIdentity: {
id,
},
};
}
constructor(options: GithubAuthProviderOptions) {
this._strategy = new GithubStrategy(
{
@@ -104,17 +54,12 @@ export class GithubAuthProvider implements OAuthHandlers {
},
(
accessToken: any,
_: any,
refreshToken: any,
params: any,
rawProfile: any,
done: PassportDoneCallback<OAuthResponse>,
fullProfile: any,
done: PassportDoneCallback<OAuthResult>,
) => {
const oauthResponse = GithubAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
);
done(undefined, oauthResponse);
done(undefined, { fullProfile, params, accessToken, refreshToken });
},
);
}
@@ -127,51 +72,73 @@ export class GithubAuthProvider implements OAuthHandlers {
}
async handler(req: express.Request) {
const { response } = await executeFrameHandlerStrategy<OAuthResponse>(
req,
this._strategy,
const {
result: { fullProfile, accessToken, params },
} = await executeFrameHandlerStrategy<OAuthResult>(req, this._strategy);
const profile = makeProfileInfo(
{
...fullProfile,
id: fullProfile.username || fullProfile.id,
displayName:
fullProfile.displayName || fullProfile.username || fullProfile.id,
},
params.id_token,
);
return { response };
return {
response: {
profile,
providerInfo: {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
backstageIdentity: {
id: fullProfile.username || fullProfile.id,
},
},
};
}
}
export const createGithubProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const enterpriseInstanceUrl = envConfig.getOptionalString(
'enterpriseInstanceUrl',
);
const authorizationUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/authorize`
: undefined;
const tokenUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/access_token`
: undefined;
const userProfileUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/api/v3/user`
: undefined;
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type GithubProviderOptions = {};
const provider = new GithubAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenUrl,
userProfileUrl,
authorizationUrl,
});
export const createGithubProvider = (
_options?: GithubProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const enterpriseInstanceUrl = envConfig.getOptionalString(
'enterpriseInstanceUrl',
);
const authorizationUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/authorize`
: undefined;
const tokenUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/login/oauth/access_token`
: undefined;
const userProfileUrl = enterpriseInstanceUrl
? `${enterpriseInstanceUrl}/api/v3/user`
: undefined;
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
persistScopes: true,
providerId,
tokenIssuer,
const provider = new GithubAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenUrl,
userProfileUrl,
authorizationUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
persistScopes: true,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/gitlab/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createGitlabProvider } from './provider';
export type { GitlabProviderOptions } from './provider';
plugins/auth-backend/src/providers/gitlab/provider.test.ts
+23 -12
View File
@@ -15,14 +15,21 @@
*/
import { GitlabAuthProvider } from './provider';
import * as helpers from '../../lib/passport';
import { OAuthResult } from '../../lib/oauth';
const mockFrameHandler = (jest.spyOn(
helpers,
'executeFrameHandlerStrategy',
) as unknown) as jest.MockedFunction<() => Promise<{ result: OAuthResult }>>;
describe('GitlabAuthProvider', () => {
it('should transform to type OAuthResponse', () => {
it('should transform to type OAuthResponse', async () => {
const tests = [
{
arguments: {
result: {
accessToken: '19xasczxcm9n7gacn9jdgm19me',
rawProfile: {
fullProfile: {
id: 'uid-123',
username: 'jimmymarkum',
provider: 'gitlab',
@@ -58,10 +65,10 @@ describe('GitlabAuthProvider', () => {
},
},
{
arguments: {
result: {
accessToken:
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe',
rawProfile: {
fullProfile: {
id: 'ipd12039',
username: 'daveboyle',
provider: 'gitlab',
@@ -74,6 +81,7 @@ describe('GitlabAuthProvider', () => {
},
params: {
scope: 'read_repository',
expires_in: 200,
},
},
expect: {
@@ -83,6 +91,7 @@ describe('GitlabAuthProvider', () => {
providerInfo: {
accessToken:
'ajakljsdoiahoawxbrouawucmbawe.awkxjemaneasdxwe.sodijxqeqwexeqwxe',
expiresInSeconds: 200,
scope: 'read_repository',
},
profile: {
@@ -93,14 +102,16 @@ describe('GitlabAuthProvider', () => {
},
];
const provider = new GitlabAuthProvider({
clientId: 'mock',
clientSecret: 'mock',
callbackUrl: 'mock',
baseUrl: 'mock',
});
for (const test of tests) {
expect(
GitlabAuthProvider.transformOAuthResponse(
test.arguments.accessToken,
test.arguments.rawProfile,
test.arguments.params,
),
).toEqual(test.expect);
mockFrameHandler.mockResolvedValueOnce({ result: test.result });
const { response } = await provider.handler({} as any);
expect(response).toEqual(test.expect);
}
});
});
plugins/auth-backend/src/providers/gitlab/provider.ts
+67 -92
View File
@@ -31,8 +31,8 @@ import {
OAuthEnvironmentHandler,
OAuthStartRequest,
encodeState,
OAuthResult,
} from '../../lib/oauth';
import passport from 'passport';
export type GitlabAuthProviderOptions = OAuthProviderOptions & {
baseUrl: string;
@@ -41,64 +41,6 @@ export type GitlabAuthProviderOptions = OAuthProviderOptions & {
export class GitlabAuthProvider implements OAuthHandlers {
private readonly _strategy: GitlabStrategy;
static transformPassportProfile(rawProfile: any): passport.Profile {
const profile: passport.Profile = {
id: rawProfile.id,
username: rawProfile.username,
provider: rawProfile.provider,
displayName: rawProfile.displayName,
};
if (rawProfile.emails && rawProfile.emails.length > 0) {
profile.emails = rawProfile.emails;
}
if (rawProfile.avatarUrl) {
profile.photos = [{ value: rawProfile.avatarUrl }];
}
return profile;
}
static transformOAuthResponse(
accessToken: string,
rawProfile: any,
params: any = {},
): OAuthResponse {
const passportProfile = GitlabAuthProvider.transformPassportProfile(
rawProfile,
);
const profile = makeProfileInfo(passportProfile, params.id_token);
const providerInfo = {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
idToken: params.id_token,
};
// gitlab provides an id numeric value (123)
// as a fallback
let id = passportProfile!.id;
if (profile.email) {
id = profile.email.split('@')[0];
}
if (params.expires_in) {
providerInfo.expiresInSeconds = params.expires_in;
}
if (params.id_token) {
providerInfo.idToken = params.id_token;
}
return {
providerInfo,
profile,
backstageIdentity: {
id,
},
};
}
constructor(options: GitlabAuthProviderOptions) {
this._strategy = new GitlabStrategy(
{
@@ -109,17 +51,12 @@ export class GitlabAuthProvider implements OAuthHandlers {
},
(
accessToken: any,
_: any,
refreshToken: any,
params: any,
rawProfile: any,
done: PassportDoneCallback<OAuthResponse>,
fullProfile: any,
done: PassportDoneCallback<OAuthResult>,
) => {
const oauthResponse = GitlabAuthProvider.transformOAuthResponse(
accessToken,
rawProfile,
params,
);
done(undefined, oauthResponse);
done(undefined, { fullProfile, params, accessToken, refreshToken });
},
);
}
@@ -132,36 +69,74 @@ export class GitlabAuthProvider implements OAuthHandlers {
}
async handler(req: express.Request): Promise<{ response: OAuthResponse }> {
return await executeFrameHandlerStrategy<OAuthResponse>(
const { result } = await executeFrameHandlerStrategy<OAuthResult>(
req,
this._strategy,
);
const { accessToken, params } = result;
const fullProfile = result.fullProfile as OAuthResult['fullProfile'] & {
avatarUrl?: string;
};
const profile = makeProfileInfo(
{
...fullProfile,
photos: [
...(fullProfile.photos ?? []),
...(fullProfile.avatarUrl ? [{ value: fullProfile.avatarUrl }] : []),
],
},
params.id_token,
);
// gitlab provides an id numeric value (123)
// as a fallback
let id = fullProfile.id;
if (profile.email) {
id = profile.email.split('@')[0];
}
return {
response: {
profile,
providerInfo: {
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
idToken: params.id_token,
},
backstageIdentity: {
id,
},
},
};
}
}
export const createGitlabProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const baseUrl = audience || 'https://gitlab.com';
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type GitlabProviderOptions = {};
const provider = new GitlabAuthProvider({
clientId,
clientSecret,
callbackUrl,
baseUrl,
});
export const createGitlabProvider = (
_options?: GitlabProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const baseUrl = audience || 'https://gitlab.com';
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
const provider = new GitlabAuthProvider({
clientId,
clientSecret,
callbackUrl,
baseUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: true,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/google/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createGoogleProvider } from './provider';
export type { GoogleProviderOptions } from './provider';
plugins/auth-backend/src/providers/google/provider.ts
+69 -45
View File
@@ -28,6 +28,7 @@ import {
OAuthRefreshRequest,
OAuthResponse,
OAuthStartRequest,
OAuthResult,
} from '../../lib/oauth';
import {
executeFetchUserProfileStrategy,
@@ -38,24 +39,28 @@ import {
PassportDoneCallback,
} from '../../lib/passport';
import { AuthProviderFactory, RedirectInfo } from '../types';
import { TokenIssuer } from '../../identity';
type PrivateInfo = {
refreshToken: string;
};
export type GoogleAuthProviderOptions = OAuthProviderOptions & {
type Options = OAuthProviderOptions & {
logger: Logger;
identityClient: CatalogIdentityClient;
tokenIssuer: TokenIssuer;
};
export class GoogleAuthProvider implements OAuthHandlers {
private readonly _strategy: GoogleStrategy;
private readonly logger: Logger;
private readonly identityClient: CatalogIdentityClient;
private readonly tokenIssuer: TokenIssuer;
constructor(options: GoogleAuthProviderOptions) {
constructor(options: Options) {
this.logger = options.logger;
this.identityClient = options.identityClient;
this.tokenIssuer = options.tokenIssuer;
// TODO: throw error if env variables not set?
this._strategy = new GoogleStrategy(
{
@@ -70,20 +75,16 @@ export class GoogleAuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
fullProfile,
params,
accessToken,
refreshToken,
},
{
refreshToken,
@@ -105,13 +106,23 @@ export class GoogleAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
profile,
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -123,11 +134,11 @@ export class GoogleAuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -150,11 +161,17 @@ export class GoogleAuthProvider implements OAuthHandlers {
}
try {
const user = await this.identityClient.findUser({
annotations: {
'google.com/email': profile.email,
},
const token = await this.tokenIssuer.issueToken({
claims: { sub: 'backstage.io/auth-backend' },
});
const user = await this.identityClient.findUser(
{
annotations: {
'google.com/email': profile.email,
},
},
{ token },
);
return {
...response,
@@ -174,30 +191,37 @@ export class GoogleAuthProvider implements OAuthHandlers {
}
}
export const createGoogleProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
logger,
tokenIssuer,
catalogApi,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type GoogleProviderOptions = {};
const provider = new GoogleAuthProvider({
clientId,
clientSecret,
callbackUrl,
logger,
identityClient: new CatalogIdentityClient({ catalogApi }),
});
export const createGoogleProvider = (
_options?: GoogleProviderOptions,
): AuthProviderFactory => {
return ({
providerId,
globalConfig,
config,
logger,
tokenIssuer,
catalogApi,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new GoogleAuthProvider({
clientId,
clientSecret,
callbackUrl,
logger,
tokenIssuer,
identityClient: new CatalogIdentityClient({ catalogApi }),
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/microsoft/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createMicrosoftProvider } from './provider';
export type { MicrosoftProviderOptions } from './provider';
plugins/auth-backend/src/providers/microsoft/provider.ts
+61 -75
View File
@@ -38,6 +38,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import got from 'got';
@@ -54,32 +55,6 @@ export type MicrosoftAuthProviderOptions = OAuthProviderOptions & {
export class MicrosoftAuthProvider implements OAuthHandlers {
private readonly _strategy: MicrosoftStrategy;
static transformAuthResponse(
accessToken: string,
params: any,
rawProfile: any,
photoURL: any,
): OAuthResponse {
let passportProfile: passport.Profile = rawProfile;
passportProfile = {
...passportProfile,
photos: [{ value: photoURL }],
};
const profile = makeProfileInfo(passportProfile, params.id_token);
const providerInfo = {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
};
return {
providerInfo,
profile,
};
}
constructor(options: MicrosoftAuthProviderOptions) {
this._strategy = new MicrosoftStrategy(
{
@@ -94,22 +69,10 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
this.getUserPhoto(accessToken)
.then(photoURL => {
const authResponse = MicrosoftAuthProvider.transformAuthResponse(
accessToken,
params,
rawProfile,
photoURL,
);
done(undefined, authResponse, { refreshToken });
})
.catch(error => {
throw new Error(`Error processing auth response: ${error}`);
});
done(undefined, { fullProfile, accessToken, refreshToken, params });
},
);
}
@@ -124,15 +87,37 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
return {
response: await this.populateIdentity(response),
refreshToken: privateInfo.refreshToken,
};
try {
const photoUrl = await this.getUserPhoto(result.accessToken);
const profile = makeProfileInfo(
{
...result.fullProfile,
photos: photoUrl ? [{ value: photoUrl }] : undefined,
},
result.params.id_token,
);
return {
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
} catch (error) {
throw new Error(`Error processing auth response: ${error}`);
}
}
async refresh(req: OAuthRefreshRequest): Promise<OAuthResponse> {
@@ -142,11 +127,11 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
const photo = await this.getUserPhoto(accessToken);
if (photo) {
profile.picture = photo;
@@ -205,32 +190,33 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
}
}
export const createMicrosoftProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const tenantID = envConfig.getString('tenantId');
export type MicrosoftProviderOptions = {};
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/authorize`;
const tokenUrl = `https://login.microsoftonline.com/${tenantID}/oauth2/v2.0/token`;
export const createMicrosoftProvider = (
_options?: MicrosoftProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const tenantId = envConfig.getString('tenantId');
const provider = new MicrosoftAuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
const provider = new MicrosoftAuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
};
plugins/auth-backend/src/providers/oauth2/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createOAuth2Provider } from './provider';
export type { OAuth2ProviderOptions } from './provider';
plugins/auth-backend/src/providers/oauth2/provider.ts
+51 -40
View File
@@ -26,6 +26,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import {
executeFetchUserProfileStrategy,
@@ -44,6 +45,7 @@ type PrivateInfo = {
export type OAuth2AuthProviderOptions = OAuthProviderOptions & {
authorizationUrl: string;
tokenUrl: string;
scope?: string;
};
export class OAuth2AuthProvider implements OAuthHandlers {
@@ -58,26 +60,22 @@ export class OAuth2AuthProvider implements OAuthHandlers {
authorizationURL: options.authorizationUrl,
tokenURL: options.tokenUrl,
passReqToCallback: false as true,
scope: options.scope,
},
(
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
fullProfile,
accessToken,
refreshToken,
params,
},
{
refreshToken,
@@ -99,13 +97,23 @@ export class OAuth2AuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -122,11 +130,11 @@ export class OAuth2AuthProvider implements OAuthHandlers {
refreshToken: updatedRefreshToken,
} = refreshTokenResponse;
const profile = await executeFetchUserProfileStrategy(
const rawProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(rawProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -156,30 +164,33 @@ export class OAuth2AuthProvider implements OAuthHandlers {
}
}
export const createOAuth2Provider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = envConfig.getString('authorizationUrl');
const tokenUrl = envConfig.getString('tokenUrl');
export type OAuth2ProviderOptions = {};
const provider = new OAuth2AuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
});
export const createOAuth2Provider = (
_options?: OAuth2ProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const authorizationUrl = envConfig.getString('authorizationUrl');
const tokenUrl = envConfig.getString('tokenUrl');
const scope = envConfig.getOptionalString('scope');
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OAuth2AuthProvider({
clientId,
clientSecret,
callbackUrl,
authorizationUrl,
tokenUrl,
scope,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/oidc/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createOidcProvider } from './provider';
export type { OidcProviderOptions } from './provider';
plugins/auth-backend/src/providers/oidc/provider.test.ts
+1 -1
View File
@@ -121,7 +121,7 @@ describe('OidcAuthProvider', () => {
})),
} as any) as Config,
} as AuthProviderFactoryOptions;
const provider = createOidcProvider(options) as OAuthAdapter;
const provider = createOidcProvider()(options) as OAuthAdapter;
expect(provider.start).toBeDefined();
await new Promise(resolve => process.nextTick(resolve)); // advance a tick to give nock a chance to intercept the request
expect(scope.isDone()).toBeTruthy();
plugins/auth-backend/src/providers/oidc/provider.ts
+62 -57
View File
@@ -37,10 +37,10 @@ import {
executeRedirectStrategy,
PassportDoneCallback,
} from '../../lib/passport';
import { RedirectInfo, AuthProviderFactory, ProfileInfo } from '../types';
import { RedirectInfo, AuthProviderFactory } from '../types';
type PrivateInfo = {
refreshToken: string;
refreshToken?: string;
};
type OidcImpl = {
@@ -48,7 +48,12 @@ type OidcImpl = {
client: Client;
};
export type OidcAuthProviderOptions = OAuthProviderOptions & {
type AuthResult = {
tokenset: TokenSet;
userinfo: UserinfoResponse;
};
export type Options = OAuthProviderOptions & {
metadataUrl: string;
tokenSignedResponseAlg?: string;
};
@@ -56,7 +61,7 @@ export type OidcAuthProviderOptions = OAuthProviderOptions & {
export class OidcAuthProvider implements OAuthHandlers {
private readonly implementation: Promise<OidcImpl>;
constructor(options: OidcAuthProviderOptions) {
constructor(options: Options) {
this.implementation = this.setupStrategy(options);
}
@@ -65,22 +70,37 @@ export class OidcAuthProvider implements OAuthHandlers {
return await executeRedirectStrategy(req, strategy, {
accessType: 'offline',
prompt: 'none',
scope: `${req.scope} default`,
scope: req.scope,
state: encodeState(req.state),
});
}
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
): Promise<{ response: OAuthResponse; refreshToken?: string }> {
const { strategy } = await this.implementation;
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
PrivateInfo
>(req, strategy);
const {
result: { userinfo, tokenset },
privateInfo,
} = await executeFrameHandlerStrategy<AuthResult, PrivateInfo>(
req,
strategy,
);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile: {
displayName: userinfo.name,
email: userinfo.email,
picture: userinfo.picture,
},
providerInfo: {
idToken: tokenset.id_token,
accessToken: tokenset.access_token || '',
scope: tokenset.scope || '',
expiresInSeconds: tokenset.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -105,9 +125,7 @@ export class OidcAuthProvider implements OAuthHandlers {
});
}
private async setupStrategy(
options: OidcAuthProviderOptions,
): Promise<OidcImpl> {
private async setupStrategy(options: Options): Promise<OidcImpl> {
const issuer = await Issuer.discover(options.metadataUrl);
const client = new issuer.Client({
client_id: options.clientId,
@@ -125,27 +143,13 @@ export class OidcAuthProvider implements OAuthHandlers {
(
tokenset: TokenSet,
userinfo: UserinfoResponse,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
done: PassportDoneCallback<AuthResult, PrivateInfo>,
) => {
const profile: ProfileInfo = {
displayName: userinfo.name,
email: userinfo.email,
picture: userinfo.picture,
};
done(
undefined,
{ tokenset, userinfo },
{
providerInfo: {
idToken: tokenset.id_token || '',
accessToken: tokenset.access_token || '',
scope: tokenset.scope || '',
expiresInSeconds: tokenset.expires_in,
},
profile,
},
{
refreshToken: tokenset.refresh_token || '',
refreshToken: tokenset.refresh_token,
},
);
},
@@ -170,32 +174,33 @@ export class OidcAuthProvider implements OAuthHandlers {
}
}
export const createOidcProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const metadataUrl = envConfig.getString('metadataUrl');
const tokenSignedResponseAlg = envConfig.getString(
'tokenSignedResponseAlg',
);
export type OidcProviderOptions = {};
const provider = new OidcAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenSignedResponseAlg,
metadataUrl,
});
export const createOidcProvider = (
_options?: OidcProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
const metadataUrl = envConfig.getString('metadataUrl');
const tokenSignedResponseAlg = envConfig.getString(
'tokenSignedResponseAlg',
);
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OidcAuthProvider({
clientId,
clientSecret,
callbackUrl,
tokenSignedResponseAlg,
metadataUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/okta/index.ts
+2
View File
@@ -13,4 +13,6 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
export { createOktaProvider } from './provider';
export type { OktaProviderOptions } from './provider';
plugins/auth-backend/src/providers/okta/provider.ts
+45 -38
View File
@@ -23,6 +23,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import { Strategy as OktaStrategy } from 'passport-okta-oauth';
import passport from 'passport';
@@ -80,21 +81,16 @@ export class OktaAuthProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
accessToken,
refreshToken,
params,
fullProfile,
},
{
refreshToken,
@@ -116,13 +112,23 @@ export class OktaAuthProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -134,11 +140,11 @@ export class OktaAuthProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -167,28 +173,29 @@ export class OktaAuthProvider implements OAuthHandlers {
}
}
export const createOktaProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type OktaProviderOptions = {};
const provider = new OktaAuthProvider({
audience,
clientId,
clientSecret,
callbackUrl,
});
export const createOktaProvider = (
_options?: OktaProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const audience = envConfig.getString('audience');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OktaAuthProvider({
audience,
clientId,
clientSecret,
callbackUrl,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/onelogin/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createOneLoginProvider } from './provider';
export type { OneLoginProviderOptions } from './provider';
plugins/auth-backend/src/providers/onelogin/provider.ts
+47 -40
View File
@@ -25,6 +25,7 @@ import {
OAuthStartRequest,
encodeState,
OAuthRefreshRequest,
OAuthResult,
} from '../../lib/oauth';
import passport from 'passport';
import {
@@ -41,14 +42,14 @@ type PrivateInfo = {
refreshToken: string;
};
export type OneLoginProviderOptions = OAuthProviderOptions & {
export type Options = OAuthProviderOptions & {
issuer: string;
};
export class OneLoginProvider implements OAuthHandlers {
private readonly _strategy: any;
constructor(options: OneLoginProviderOptions) {
constructor(options: Options) {
this._strategy = new OneLoginStrategy(
{
issuer: options.issuer,
@@ -61,21 +62,16 @@ export class OneLoginProvider implements OAuthHandlers {
accessToken: any,
refreshToken: any,
params: any,
rawProfile: passport.Profile,
done: PassportDoneCallback<OAuthResponse, PrivateInfo>,
fullProfile: passport.Profile,
done: PassportDoneCallback<OAuthResult, PrivateInfo>,
) => {
const profile = makeProfileInfo(rawProfile, params.id_token);
done(
undefined,
{
providerInfo: {
idToken: params.id_token,
accessToken,
scope: params.scope,
expiresInSeconds: params.expires_in,
},
profile,
accessToken,
refreshToken,
params,
fullProfile,
},
{
refreshToken,
@@ -96,13 +92,23 @@ export class OneLoginProvider implements OAuthHandlers {
async handler(
req: express.Request,
): Promise<{ response: OAuthResponse; refreshToken: string }> {
const { response, privateInfo } = await executeFrameHandlerStrategy<
OAuthResponse,
const { result, privateInfo } = await executeFrameHandlerStrategy<
OAuthResult,
PrivateInfo
>(req, this._strategy);
const profile = makeProfileInfo(result.fullProfile, result.params.id_token);
return {
response: await this.populateIdentity(response),
response: await this.populateIdentity({
profile,
providerInfo: {
idToken: result.params.id_token,
accessToken: result.accessToken,
scope: result.params.scope,
expiresInSeconds: result.params.expires_in,
},
}),
refreshToken: privateInfo.refreshToken,
};
}
@@ -114,11 +120,11 @@ export class OneLoginProvider implements OAuthHandlers {
req.scope,
);
const profile = await executeFetchUserProfileStrategy(
const fullProfile = await executeFetchUserProfileStrategy(
this._strategy,
accessToken,
params.id_token,
);
const profile = makeProfileInfo(fullProfile, params.id_token);
return this.populateIdentity({
providerInfo: {
@@ -146,28 +152,29 @@ export class OneLoginProvider implements OAuthHandlers {
}
}
export const createOneLoginProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const issuer = envConfig.getString('issuer');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
export type OneLoginProviderOptions = {};
const provider = new OneLoginProvider({
clientId,
clientSecret,
callbackUrl,
issuer,
});
export const createOneLoginProvider = (
_options?: OneLoginProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) =>
OAuthEnvironmentHandler.mapConfig(config, envConfig => {
const clientId = envConfig.getString('clientId');
const clientSecret = envConfig.getString('clientSecret');
const issuer = envConfig.getString('issuer');
const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
const provider = new OneLoginProvider({
clientId,
clientSecret,
callbackUrl,
issuer,
});
return OAuthAdapter.fromConfig(globalConfig, provider, {
disableRefresh: false,
providerId,
tokenIssuer,
});
});
});
};
plugins/auth-backend/src/providers/saml/index.ts
+1
View File
@@ -15,3 +15,4 @@
*/
export { createSamlProvider } from './provider';
export type { SamlProviderOptions } from './provider';
plugins/auth-backend/src/providers/saml/provider.ts
+48 -53
View File
@@ -26,17 +26,17 @@ import {
executeRedirectStrategy,
PassportDoneCallback,
} from '../../lib/passport';
import {
AuthProviderRouteHandlers,
ProfileInfo,
AuthProviderFactory,
} from '../types';
import { AuthProviderRouteHandlers, AuthProviderFactory } from '../types';
import { postMessageResponse } from '../../lib/flow';
import { TokenIssuer } from '../../identity';
type SamlInfo = {
userId: string;
profile: ProfileInfo;
fullProfile: any;
};
type Options = SamlConfig & {
tokenIssuer: TokenIssuer;
appUrl: string;
};
export class SamlAuthProvider implements AuthProviderRouteHandlers {
@@ -44,11 +44,11 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
private readonly tokenIssuer: TokenIssuer;
private readonly appUrl: string;
constructor(options: SAMLProviderOptions) {
constructor(options: Options) {
this.appUrl = options.appUrl;
this.tokenIssuer = options.tokenIssuer;
this.strategy = new SamlStrategy({ ...options }, ((
profile: SamlProfile,
fullProfile: SamlProfile,
done: PassportDoneCallback<SamlInfo>,
) => {
// TODO: There's plenty more validation and profile handling to do here,
@@ -56,13 +56,7 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
// for non-oauth auth flows.
// TODO: This flow doesn't issue an identity token that can be used to validate
// the identity of the user in other backends, which we need in some form.
done(undefined, {
userId: profile.nameID!,
profile: {
email: profile.email!,
displayName: profile.displayName as string,
},
});
done(undefined, { fullProfile });
}) as VerifyWithoutRequest);
}
@@ -76,11 +70,13 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
res: express.Response,
): Promise<void> {
try {
const {
response: { userId, profile },
} = await executeFrameHandlerStrategy<SamlInfo>(req, this.strategy);
const { result } = await executeFrameHandlerStrategy<SamlInfo>(
req,
this.strategy,
);
const id = result.fullProfile.nameID;
const id = userId;
const idToken = await this.tokenIssuer.issueToken({
claims: { sub: id },
});
@@ -88,8 +84,11 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
return postMessageResponse(res, this.appUrl, {
type: 'authorization_response',
response: {
profile: {
email: result.fullProfile.email,
displayName: result.fullProfile.displayName,
},
providerInfo: {},
profile,
backstageIdentity: { id, idToken },
},
});
@@ -113,40 +112,36 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
}
}
type SAMLProviderOptions = SamlConfig & {
tokenIssuer: TokenIssuer;
appUrl: string;
};
type SignatureAlgorithm = 'sha1' | 'sha256' | 'sha512';
export const createSamlProvider: AuthProviderFactory = ({
providerId,
globalConfig,
config,
tokenIssuer,
}) => {
const opts = {
callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
entryPoint: config.getString('entryPoint'),
logoutUrl: config.getOptionalString('logoutUrl'),
issuer: config.getString('issuer'),
cert: config.getOptionalString('cert'),
privateCert: config.getOptionalString('privateKey'),
decryptionPvk: config.getOptionalString('decryptionPvk'),
signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as
| SignatureAlgorithm
| undefined,
digestAlgorithm: config.getOptionalString('digestAlgorithm'),
export type SamlProviderOptions = {};
tokenIssuer,
appUrl: globalConfig.appUrl,
export const createSamlProvider = (
_options?: SamlProviderOptions,
): AuthProviderFactory => {
return ({ providerId, globalConfig, config, tokenIssuer }) => {
const opts = {
callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`,
entryPoint: config.getString('entryPoint'),
logoutUrl: config.getOptionalString('logoutUrl'),
issuer: config.getString('issuer'),
cert: config.getOptionalString('cert'),
privateCert: config.getOptionalString('privateKey'),
decryptionPvk: config.getOptionalString('decryptionPvk'),
signatureAlgorithm: config.getOptionalString('signatureAlgorithm') as
| SignatureAlgorithm
| undefined,
digestAlgorithm: config.getOptionalString('digestAlgorithm'),
tokenIssuer,
appUrl: globalConfig.appUrl,
};
// passport-saml will return an error if the `cert` key is set, and the value is empty.
// Since we read from config (such as environment variables) an empty string should be equal to being unset.
if (!opts.cert) {
delete opts.cert;
}
return new SamlAuthProvider(opts);
};
// passport-saml will return an error if the `cert` key is set, and the value is empty.
// Since we read from config (such as environment variables) an empty string should be equal to being unset.
if (!opts.cert) {
delete opts.cert;
}
return new SamlAuthProvider(opts);
};