diff --git a/.changeset/rotten-lemons-cry.md b/.changeset/rotten-lemons-cry.md new file mode 100644 index 0000000000..2bcc4c2ea7 --- /dev/null +++ b/.changeset/rotten-lemons-cry.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend-module-microsoft-provider': patch +--- + +Added the possibility to use custom scopes for performing login with Microsoft EntraID. diff --git a/docs/auth/microsoft/provider.md b/docs/auth/microsoft/provider.md index 999e1f40d2..bb8a7db6e4 100644 --- a/docs/auth/microsoft/provider.md +++ b/docs/auth/microsoft/provider.md @@ -28,6 +28,7 @@ On the **API permissions** tab, click on `Add Permission`, then add the followin - `openid` - `profile` - `User.Read` +- Optional custom scopes of the `Microsoft Graph` API defined in the app-config.yaml file. Your company may require you to grant [admin consent](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/user-admin-consent-overview) for these permissions. Even if your company doesn't require admin consent, you may wish to do so as it means users don't need to individually consent the first time they access backstage. @@ -54,6 +55,8 @@ auth: clientSecret: ${AZURE_CLIENT_SECRET} tenantId: ${AZURE_TENANT_ID} domainHint: ${AZURE_TENANT_ID} + additionalScopes: + - Mail.Send ``` The Microsoft provider is a structure with three mandatory configuration keys: @@ -65,6 +68,7 @@ The Microsoft provider is a structure with three mandatory configuration keys: Leave blank if your app registration is multi tenant. When specified, this reduces login friction for users with accounts in multiple tenants by automatically filtering away accounts from other tenants. For more details, see [Home Realm Discovery](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy) +- `additionalScopes` (optional): List of scopes for the App Registration. The default and mandatory value is ['user.read']. ## Adding the provider to the Backstage frontend diff --git a/plugins/auth-backend-module-microsoft-provider/config.d.ts b/plugins/auth-backend-module-microsoft-provider/config.d.ts index aa78f72271..df63e9ccf4 100644 --- a/plugins/auth-backend-module-microsoft-provider/config.d.ts +++ b/plugins/auth-backend-module-microsoft-provider/config.d.ts @@ -28,6 +28,7 @@ export interface Config { clientSecret: string; domainHint?: string; callbackUrl?: string; + additionalScopes?: string[]; }; }; }; diff --git a/plugins/auth-backend-module-microsoft-provider/package.json b/plugins/auth-backend-module-microsoft-provider/package.json index 9412575200..94dddfc7ac 100644 --- a/plugins/auth-backend-module-microsoft-provider/package.json +++ b/plugins/auth-backend-module-microsoft-provider/package.json @@ -27,6 +27,7 @@ "@backstage/plugin-auth-node": "workspace:^", "express": "^4.18.2", "jose": "^4.6.0", + "lodash": "^4.17.21", "node-fetch": "^2.6.7", "passport": "^0.7.0", "passport-microsoft": "^1.0.0" diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts index 35d35c464c..21a60a229b 100644 --- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts +++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.test.ts @@ -113,6 +113,7 @@ describe('microsoftAuthenticator', () => { tenantId: 'tenantId', clientId: 'clientId', clientSecret: 'clientSecret', + additionalScopes: ['User.Read.All'], }), }); }); diff --git a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts index 52ef1ddd90..1b6eb87fae 100644 --- a/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts +++ b/plugins/auth-backend-module-microsoft-provider/src/authenticator.ts @@ -21,6 +21,7 @@ import { PassportProfile, } from '@backstage/plugin-auth-node'; import { ExtendedMicrosoftStrategy } from './strategy'; +import { union } from 'lodash'; /** @public */ export const microsoftAuthenticator = createOAuthAuthenticator({ @@ -31,6 +32,10 @@ export const microsoftAuthenticator = createOAuthAuthenticator({ const clientSecret = config.getString('clientSecret'); const tenantId = config.getString('tenantId'); const domainHint = config.getOptionalString('domainHint'); + const scope = union( + ['user.read'], + config.getOptionalStringArray('additionalScopes'), + ); const helper = PassportOAuthAuthenticatorHelper.from( new ExtendedMicrosoftStrategy( @@ -39,7 +44,7 @@ export const microsoftAuthenticator = createOAuthAuthenticator({ clientSecret: clientSecret, callbackURL: callbackUrl, tenant: tenantId, - scope: ['user.read'], + scope: scope, }, ( accessToken: string, diff --git a/plugins/auth-backend-module-microsoft-provider/src/module.test.ts b/plugins/auth-backend-module-microsoft-provider/src/module.test.ts index 21f9a7e845..2ef92c0b44 100644 --- a/plugins/auth-backend-module-microsoft-provider/src/module.test.ts +++ b/plugins/auth-backend-module-microsoft-provider/src/module.test.ts @@ -38,6 +38,7 @@ describe('authModuleMicrosoftProvider', () => { clientId: 'my-client-id', clientSecret: 'my-client-secret', tenantId: 'my-tenant-id', + additionalScopes: ['User.Read.All'], }, }, }, @@ -66,7 +67,7 @@ describe('authModuleMicrosoftProvider', () => { expect(startUrl.pathname).toBe('/my-tenant-id/oauth2/v2.0/authorize'); expect(Object.fromEntries(startUrl.searchParams)).toEqual({ response_type: 'code', - scope: 'user.read', + scope: 'user.read User.Read.All', client_id: 'my-client-id', redirect_uri: `http://localhost:${server.port()}/api/auth/microsoft/handler/frame`, state: expect.any(String), diff --git a/yarn.lock b/yarn.lock index 28e6b73f7d..dc76ef0101 100644 --- a/yarn.lock +++ b/yarn.lock @@ -4636,6 +4636,7 @@ __metadata: "@types/passport-microsoft": ^1.0.0 express: ^4.18.2 jose: ^4.6.0 + lodash: ^4.17.21 msw: ^1.0.0 node-fetch: ^2.6.7 passport: ^0.7.0