@backstage/plugin-auth-backend-module-auth0-provider 0.3.2-next.0 → 0.4.0-next.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +21 -0
- package/config.d.ts +5 -0
- package/dist/authenticator.cjs.js +22 -1
- package/dist/authenticator.cjs.js.map +1 -1
- package/dist/index.d.ts +3 -0
- package/package.json +8 -8
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,26 @@
|
|
|
1
1
|
# @backstage/plugin-auth-backend-module-auth0-provider
|
|
2
2
|
|
|
3
|
+
## 0.4.0-next.2
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 9244b70: Added federated logout support. Set `federatedLogout: true` in the Auth0 provider config to clear both the Auth0 session and any upstream IdP session on sign-out. The authenticator returns a logout URL that redirects the browser to Auth0's `/v2/logout?federated` endpoint, ensuring users must fully re-authenticate after signing out.
|
|
8
|
+
|
|
9
|
+
### Patch Changes
|
|
10
|
+
|
|
11
|
+
- Updated dependencies
|
|
12
|
+
- @backstage/errors@1.3.0-next.0
|
|
13
|
+
- @backstage/plugin-auth-node@0.7.0-next.2
|
|
14
|
+
- @backstage/backend-plugin-api@1.9.0-next.2
|
|
15
|
+
|
|
16
|
+
## 0.3.2-next.1
|
|
17
|
+
|
|
18
|
+
### Patch Changes
|
|
19
|
+
|
|
20
|
+
- Updated dependencies
|
|
21
|
+
- @backstage/backend-plugin-api@1.9.0-next.1
|
|
22
|
+
- @backstage/plugin-auth-node@0.7.0-next.1
|
|
23
|
+
|
|
3
24
|
## 0.3.2-next.0
|
|
4
25
|
|
|
5
26
|
### Patch Changes
|
package/config.d.ts
CHANGED
|
@@ -33,6 +33,11 @@ export interface Config {
|
|
|
33
33
|
connection?: string;
|
|
34
34
|
connectionScope?: string;
|
|
35
35
|
organization?: string;
|
|
36
|
+
/**
|
|
37
|
+
* Whether to perform federated logout, clearing both the Auth0
|
|
38
|
+
* session and any upstream IdP session. Defaults to false.
|
|
39
|
+
*/
|
|
40
|
+
federatedLogout?: boolean;
|
|
36
41
|
sessionDuration?: HumanDuration | string;
|
|
37
42
|
};
|
|
38
43
|
};
|
|
@@ -50,7 +50,16 @@ const auth0Authenticator = pluginAuthNode.createOAuthAuthenticator({
|
|
|
50
50
|
}
|
|
51
51
|
)
|
|
52
52
|
);
|
|
53
|
-
|
|
53
|
+
const federated = config.getOptionalBoolean("federatedLogout") ?? false;
|
|
54
|
+
return {
|
|
55
|
+
helper,
|
|
56
|
+
audience,
|
|
57
|
+
connection,
|
|
58
|
+
connectionScope,
|
|
59
|
+
domain,
|
|
60
|
+
clientID,
|
|
61
|
+
federated
|
|
62
|
+
};
|
|
54
63
|
},
|
|
55
64
|
async start(input, { helper, audience, connection, connectionScope: connection_scope }) {
|
|
56
65
|
return helper.start(input, {
|
|
@@ -70,6 +79,18 @@ const auth0Authenticator = pluginAuthNode.createOAuthAuthenticator({
|
|
|
70
79
|
},
|
|
71
80
|
async refresh(input, { helper }) {
|
|
72
81
|
return helper.refresh(input);
|
|
82
|
+
},
|
|
83
|
+
async logout(input, { domain, clientID, federated }) {
|
|
84
|
+
const logoutUrl = new URL(`https://${domain}/v2/logout`);
|
|
85
|
+
if (federated) {
|
|
86
|
+
logoutUrl.searchParams.set("federated", "");
|
|
87
|
+
}
|
|
88
|
+
logoutUrl.searchParams.set("client_id", clientID);
|
|
89
|
+
const origin = input.req.get("origin");
|
|
90
|
+
if (origin) {
|
|
91
|
+
logoutUrl.searchParams.set("returnTo", origin);
|
|
92
|
+
}
|
|
93
|
+
return { logoutUrl: logoutUrl.toString() };
|
|
73
94
|
}
|
|
74
95
|
});
|
|
75
96
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport {\n createOAuthAuthenticator,\n PassportOAuthAuthenticatorHelper,\n PassportOAuthDoneCallback,\n PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { Auth0Strategy } from './strategy';\n\n/** @public */\nexport const auth0Authenticator = createOAuthAuthenticator({\n defaultProfileTransform:\n PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n initialize({ callbackUrl, config }) {\n const clientID = config.getString('clientId');\n const clientSecret = config.getString('clientSecret');\n const domain = config.getString('domain');\n const audience = config.getOptionalString('audience');\n const connection = config.getOptionalString('connection');\n const connectionScope = config.getOptionalString('connectionScope');\n const callbackURL = config.getOptionalString('callbackUrl') ?? callbackUrl;\n const organization = config.getOptionalString('organization');\n // Due to passport-auth0 forcing options.state = true,\n // passport-oauth2 requires express-session to be installed\n // so that the 'state' parameter of the oauth2 flow can be stored.\n // This implementation of StateStore matches the NullStore found within\n // passport-oauth2, which is the StateStore implementation used when options.state = false,\n // allowing us to avoid using express-session in order to integrate with auth0.\n const store = {\n store(_req: express.Request, cb: any) {\n cb(null, null);\n },\n verify(_req: express.Request, _state: string, cb: any) {\n cb(null, true);\n },\n };\n\n const helper = PassportOAuthAuthenticatorHelper.from(\n new Auth0Strategy(\n {\n clientID,\n clientSecret,\n callbackURL,\n domain,\n store,\n organization,\n // We need passReqToCallback set to false to get params, but there's\n // no matching type signature for that, so instead behold this beauty\n passReqToCallback: false as true,\n },\n (\n accessToken: string,\n refreshToken: string,\n params: any,\n fullProfile: PassportProfile,\n done: PassportOAuthDoneCallback,\n ) => {\n done(\n undefined,\n {\n fullProfile,\n accessToken,\n params,\n },\n {\n refreshToken,\n },\n );\n },\n ),\n );\n return {
|
|
1
|
+
{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport {\n createOAuthAuthenticator,\n PassportOAuthAuthenticatorHelper,\n PassportOAuthDoneCallback,\n PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { Auth0Strategy } from './strategy';\n\n/** @public */\nexport const auth0Authenticator = createOAuthAuthenticator({\n defaultProfileTransform:\n PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n initialize({ callbackUrl, config }) {\n const clientID = config.getString('clientId');\n const clientSecret = config.getString('clientSecret');\n const domain = config.getString('domain');\n const audience = config.getOptionalString('audience');\n const connection = config.getOptionalString('connection');\n const connectionScope = config.getOptionalString('connectionScope');\n const callbackURL = config.getOptionalString('callbackUrl') ?? callbackUrl;\n const organization = config.getOptionalString('organization');\n // Due to passport-auth0 forcing options.state = true,\n // passport-oauth2 requires express-session to be installed\n // so that the 'state' parameter of the oauth2 flow can be stored.\n // This implementation of StateStore matches the NullStore found within\n // passport-oauth2, which is the StateStore implementation used when options.state = false,\n // allowing us to avoid using express-session in order to integrate with auth0.\n const store = {\n store(_req: express.Request, cb: any) {\n cb(null, null);\n },\n verify(_req: express.Request, _state: string, cb: any) {\n cb(null, true);\n },\n };\n\n const helper = PassportOAuthAuthenticatorHelper.from(\n new Auth0Strategy(\n {\n clientID,\n clientSecret,\n callbackURL,\n domain,\n store,\n organization,\n // We need passReqToCallback set to false to get params, but there's\n // no matching type signature for that, so instead behold this beauty\n passReqToCallback: false as true,\n },\n (\n accessToken: string,\n refreshToken: string,\n params: any,\n fullProfile: PassportProfile,\n done: PassportOAuthDoneCallback,\n ) => {\n done(\n undefined,\n {\n fullProfile,\n accessToken,\n params,\n },\n {\n refreshToken,\n },\n );\n },\n ),\n );\n const federated = config.getOptionalBoolean('federatedLogout') ?? false;\n return {\n helper,\n audience,\n connection,\n connectionScope,\n domain,\n clientID,\n federated,\n };\n },\n\n async start(\n input,\n { helper, audience, connection, connectionScope: connection_scope },\n ) {\n return helper.start(input, {\n accessType: 'offline',\n prompt: 'consent',\n ...(audience ? { audience } : {}),\n ...(connection ? { connection } : {}),\n ...(connection_scope ? { connection_scope } : {}),\n });\n },\n\n async authenticate(\n input,\n { helper, audience, connection, connectionScope: connection_scope },\n ) {\n return helper.authenticate(input, {\n ...(audience ? { audience } : {}),\n ...(connection ? { connection } : {}),\n ...(connection_scope ? { connection_scope } : {}),\n });\n },\n\n async refresh(input, { helper }) {\n return helper.refresh(input);\n },\n\n async logout(input, { domain, clientID, federated }) {\n const logoutUrl = new URL(`https://${domain}/v2/logout`);\n if (federated) {\n logoutUrl.searchParams.set('federated', '');\n }\n logoutUrl.searchParams.set('client_id', clientID);\n const origin = input.req.get('origin');\n if (origin) {\n logoutUrl.searchParams.set('returnTo', origin);\n }\n return { logoutUrl: logoutUrl.toString() };\n },\n});\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","Auth0Strategy"],"mappings":";;;;;AA0BO,MAAM,qBAAqBA,uCAAA,CAAyB;AAAA,EACzD,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,QAAQ,CAAA;AACxC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,iBAAA,CAAkB,UAAU,CAAA;AACpD,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,iBAAA,CAAkB,YAAY,CAAA;AACxD,IAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,iBAAA,CAAkB,iBAAiB,CAAA;AAClE,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,iBAAA,CAAkB,aAAa,CAAA,IAAK,WAAA;AAC/D,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,iBAAA,CAAkB,cAAc,CAAA;AAO5D,IAAA,MAAM,KAAA,GAAQ;AAAA,MACZ,KAAA,CAAM,MAAuB,EAAA,EAAS;AACpC,QAAA,EAAA,CAAG,MAAM,IAAI,CAAA;AAAA,MACf,CAAA;AAAA,MACA,MAAA,CAAO,IAAA,EAAuB,MAAA,EAAgB,EAAA,EAAS;AACrD,QAAA,EAAA,CAAG,MAAM,IAAI,CAAA;AAAA,MACf;AAAA,KACF;AAEA,IAAA,MAAM,SAASA,+CAAA,CAAiC,IAAA;AAAA,MAC9C,IAAIC,sBAAA;AAAA,QACF;AAAA,UACE,QAAA;AAAA,UACA,YAAA;AAAA,UACA,WAAA;AAAA,UACA,MAAA;AAAA,UACA,KAAA;AAAA,UACA,YAAA;AAAA;AAAA;AAAA,UAGA,iBAAA,EAAmB;AAAA,SACrB;AAAA,QACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,UAAA,IAAA;AAAA,YACE,MAAA;AAAA,YACA;AAAA,cACE,WAAA;AAAA,cACA,WAAA;AAAA,cACA;AAAA,aACF;AAAA,YACA;AAAA,cACE;AAAA;AACF,WACF;AAAA,QACF;AAAA;AACF,KACF;AACA,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,kBAAA,CAAmB,iBAAiB,CAAA,IAAK,KAAA;AAClE,IAAA,OAAO;AAAA,MACL,MAAA;AAAA,MACA,QAAA;AAAA,MACA,UAAA;AAAA,MACA,eAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAA;AAAA,EAEA,MAAM,MACJ,KAAA,EACA,EAAE,QAAQ,QAAA,EAAU,UAAA,EAAY,eAAA,EAAiB,gBAAA,EAAiB,EAClE;AACA,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ,SAAA;AAAA,MACR,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,MAC/B,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,MACnC,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB;AAAC,KAChD,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,aACJ,KAAA,EACA,EAAE,QAAQ,QAAA,EAAU,UAAA,EAAY,eAAA,EAAiB,gBAAA,EAAiB,EAClE;AACA,IAAA,OAAO,MAAA,CAAO,aAAa,KAAA,EAAO;AAAA,MAChC,GAAI,QAAA,GAAW,EAAE,QAAA,KAAa,EAAC;AAAA,MAC/B,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,MACnC,GAAI,gBAAA,GAAmB,EAAE,gBAAA,KAAqB;AAAC,KAChD,CAAA;AAAA,EACH,CAAA;AAAA,EAEA,MAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,QAAO,EAAG;AAC/B,IAAA,OAAO,MAAA,CAAO,QAAQ,KAAK,CAAA;AAAA,EAC7B,CAAA;AAAA,EAEA,MAAM,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,WAAU,EAAG;AACnD,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,CAAA,QAAA,EAAW,MAAM,CAAA,UAAA,CAAY,CAAA;AACvD,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,EAAE,CAAA;AAAA,IAC5C;AACA,IAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AAChD,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AACrC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,SAAA,CAAU,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,MAAM,CAAA;AAAA,IAC/C;AACA,IAAA,OAAO,EAAE,SAAA,EAAW,SAAA,CAAU,QAAA,EAAS,EAAE;AAAA,EAC3C;AACF,CAAC;;;;"}
|
package/dist/index.d.ts
CHANGED
|
@@ -8,6 +8,9 @@ declare const auth0Authenticator: _backstage_plugin_auth_node.OAuthAuthenticator
|
|
|
8
8
|
audience: string | undefined;
|
|
9
9
|
connection: string | undefined;
|
|
10
10
|
connectionScope: string | undefined;
|
|
11
|
+
domain: string;
|
|
12
|
+
clientID: string;
|
|
13
|
+
federated: boolean;
|
|
11
14
|
}, PassportProfile>;
|
|
12
15
|
|
|
13
16
|
/** @public */
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@backstage/plugin-auth-backend-module-auth0-provider",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0-next.2",
|
|
4
4
|
"description": "The auth0-provider backend module for the auth plugin.",
|
|
5
5
|
"backstage": {
|
|
6
6
|
"role": "backend-plugin-module",
|
|
@@ -37,19 +37,19 @@
|
|
|
37
37
|
"test": "backstage-cli package test"
|
|
38
38
|
},
|
|
39
39
|
"dependencies": {
|
|
40
|
-
"@backstage/backend-plugin-api": "1.
|
|
41
|
-
"@backstage/errors": "1.
|
|
42
|
-
"@backstage/plugin-auth-node": "0.
|
|
40
|
+
"@backstage/backend-plugin-api": "1.9.0-next.2",
|
|
41
|
+
"@backstage/errors": "1.3.0-next.0",
|
|
42
|
+
"@backstage/plugin-auth-node": "0.7.0-next.2",
|
|
43
43
|
"express": "^4.22.0",
|
|
44
44
|
"passport": "^0.7.0",
|
|
45
45
|
"passport-auth0": "^1.4.3",
|
|
46
46
|
"passport-oauth2": "^1.6.1"
|
|
47
47
|
},
|
|
48
48
|
"devDependencies": {
|
|
49
|
-
"@backstage/backend-defaults": "0.16.1-next.
|
|
50
|
-
"@backstage/backend-test-utils": "1.11.2-next.
|
|
51
|
-
"@backstage/cli": "0.36.1-next.
|
|
52
|
-
"@backstage/plugin-auth-backend": "0.28.0-next.
|
|
49
|
+
"@backstage/backend-defaults": "0.16.1-next.2",
|
|
50
|
+
"@backstage/backend-test-utils": "1.11.2-next.2",
|
|
51
|
+
"@backstage/cli": "0.36.1-next.2",
|
|
52
|
+
"@backstage/plugin-auth-backend": "0.28.0-next.2",
|
|
53
53
|
"@backstage/types": "1.2.2",
|
|
54
54
|
"@types/passport": "^1.0.3",
|
|
55
55
|
"@types/passport-auth0": "^1.0.5",
|