@backstage/plugin-auth-backend-module-okta-provider 0.0.0-nightly-20231121021721

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# @backstage/plugin-auth-backend-module-okta-provider
+
+## 0.0.0-nightly-20231121021721
+
+### Patch Changes
+
+- e1c189b52414: Adds okta-provider backend module for the auth plugin
+- Updated dependencies
+  - @backstage/backend-common@0.0.0-nightly-20231121021721
+  - @backstage/plugin-auth-node@0.0.0-nightly-20231121021721
+  - @backstage/backend-plugin-api@0.0.0-nightly-20231121021721

package/README.md

@@ -0,0 +1,30 @@
+# Auth Module: Okta Provider
+
+This module provides an Okta auth provider implementation for `@backstage/plugin-auth-backend`.
+
+## Utilization
+
+This module is used in `auth-backend/src/providers/okta`
+
+```ts
+import { oktaAuthenticator } from '@backstage/plugin-auth-backend-module-okta-provider';
+
+export const okta = createAuthProviderIntegration({
+  create({
+    authHandler?: AuthHandler<OAuthResult>,
+
+    signIn?: {
+      resolver: SignInResolver<OAuthResult>,
+    },
+  }) {
+    return createOAuthProviderFactory({
+      authenticator: oktaAuthenticator,
+    });
+  },
+});
+```
+
+## Links
+
+- [Repository](https://okta.com/backstage/backstage/tree/master/plugins/auth-backend-module-okta-provider)
+- [Backstage Project Homepage](https://backstage.io)

package/config.d.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export interface Config {
+  auth?: {
+    providers?: {
+      /** @visibility frontend */
+      okta?: {
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          audience?: string;
+          authServerId?: string;
+          idp?: string;
+          callbackUrl?: string;
+        };
+      };
+    };
+  };
+}

package/dist/index.cjs.js

@@ -0,0 +1,108 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var passportOktaOauth = require('@davidzemon/passport-okta-oauth');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var backendPluginApi = require('@backstage/backend-plugin-api');
+
+const oktaAuthenticator = pluginAuthNode.createOAuthAuthenticator({
+  defaultProfileTransform: pluginAuthNode.PassportOAuthAuthenticatorHelper.defaultProfileTransform,
+  initialize({ callbackUrl, config }) {
+    const clientId = config.getString("clientId");
+    const clientSecret = config.getString("clientSecret");
+    const audience = config.getOptionalString("audience") || "https://okta.com";
+    const authServerId = config.getOptionalString("authServerId");
+    const idp = config.getOptionalString("idp");
+    const defaultScopes = "openid profile email";
+    const additionalScopes = config.getOptionalString("additionalScopes") || "";
+    const combineScopeStrings = (scopesA, scopesB) => {
+      const scopesAArray = scopesA.split(" ");
+      const scopesBArray = scopesB.split(" ");
+      const combinedScopes = /* @__PURE__ */ new Set([...scopesAArray, ...scopesBArray]);
+      return Array.from(combinedScopes).join(" ");
+    };
+    const scope = combineScopeStrings(defaultScopes, additionalScopes);
+    return pluginAuthNode.PassportOAuthAuthenticatorHelper.from(
+      new passportOktaOauth.Strategy(
+        {
+          clientID: clientId,
+          clientSecret,
+          callbackURL: callbackUrl,
+          audience,
+          authServerID: authServerId,
+          idp,
+          passReqToCallback: false,
+          response_type: "code",
+          scope
+        },
+        (accessToken, refreshToken, params, fullProfile, done) => {
+          done(
+            void 0,
+            { fullProfile, params, accessToken },
+            { refreshToken }
+          );
+        }
+      )
+    );
+  },
+  async start(input, helper) {
+    return helper.start(input, {
+      accessType: "offline",
+      prompt: "consent"
+    });
+  },
+  async authenticate(input, helper) {
+    return helper.authenticate(input);
+  },
+  async refresh(input, helper) {
+    return helper.refresh(input);
+  }
+});
+
+exports.oktaSignInResolvers = void 0;
+((oktaSignInResolvers2) => {
+  oktaSignInResolvers2.emailMatchingUserEntityAnnotation = pluginAuthNode.createSignInResolverFactory({
+    create() {
+      return async (info, ctx) => {
+        const { profile } = info;
+        if (!profile.email) {
+          throw new Error("Okta profile contained no email");
+        }
+        return ctx.signInWithCatalogUser({
+          annotations: {
+            "okta.com/email": profile.email
+          }
+        });
+      };
+    }
+  });
+})(exports.oktaSignInResolvers || (exports.oktaSignInResolvers = {}));
+
+const authModuleOktaProvider = backendPluginApi.createBackendModule({
+  pluginId: "auth",
+  moduleId: "okta-provider",
+  register(reg) {
+    reg.registerInit({
+      deps: {
+        providers: pluginAuthNode.authProvidersExtensionPoint
+      },
+      async init({ providers }) {
+        providers.registerProvider({
+          providerId: "okta",
+          factory: pluginAuthNode.createOAuthProviderFactory({
+            authenticator: oktaAuthenticator,
+            signInResolverFactories: {
+              ...exports.oktaSignInResolvers,
+              ...pluginAuthNode.commonSignInResolvers
+            }
+          })
+        });
+      }
+    });
+  }
+});
+
+exports["default"] = authModuleOktaProvider;
+exports.oktaAuthenticator = oktaAuthenticator;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":["../src/authenticator.ts","../src/resolvers.ts","../src/module.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Strategy as OktaStrategy } from '@davidzemon/passport-okta-oauth';\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\n\n/** @public */\nexport const oktaAuthenticator = createOAuthAuthenticator({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const audience = config.getOptionalString('audience') || 'https://okta.com';\n    const authServerId = config.getOptionalString('authServerId');\n    const idp = config.getOptionalString('idp');\n    // default scopes are taken from\n    // https://developer.okta.com/docs/reference/api/oidc/#response-example-success-refresh-token\n    const defaultScopes = 'openid profile email';\n    // additional scopes can be configured in the config as a space separated string\n    const additionalScopes = config.getOptionalString('additionalScopes') || '';\n    // combine default and additional scopes and remove duplicates\n    const combineScopeStrings = (scopesA: string, scopesB: string) => {\n      const scopesAArray = scopesA.split(' ');\n      const scopesBArray = scopesB.split(' ');\n      const combinedScopes = new Set([...scopesAArray, ...scopesBArray]);\n      return Array.from(combinedScopes).join(' ');\n    };\n    const scope = combineScopeStrings(defaultScopes, additionalScopes);\n\n    return PassportOAuthAuthenticatorHelper.from(\n      new OktaStrategy(\n        {\n          clientID: clientId,\n          clientSecret: clientSecret,\n          callbackURL: callbackUrl,\n          audience: audience,\n          authServerID: authServerId,\n          idp: idp,\n          passReqToCallback: false,\n          response_type: 'code',\n          scope,\n        },\n        (\n          accessToken: string,\n          refreshToken: string,\n          params: any,\n          fullProfile: PassportProfile,\n          done: PassportOAuthDoneCallback,\n        ) => {\n          done(\n            undefined,\n            { fullProfile, params, accessToken },\n            { refreshToken },\n          );\n        },\n      ),\n    );\n  },\n\n  async start(input, helper) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n\n  async authenticate(input, helper) {\n    return helper.authenticate(input);\n  },\n\n  async refresh(input, helper) {\n    return helper.refresh(input);\n  },\n});\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\n\n/**\n * Available sign-in resolvers for the Okta auth provider.\n *\n * @public\n */\nexport namespace oktaSignInResolvers {\n  /**\n   * Looks up the user by matching their Okta   email to the entity email.\n   */\n\n  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({\n    create() {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { profile } = info;\n\n        if (!profile.email) {\n          throw new Error('Okta profile contained no email');\n        }\n\n        return ctx.signInWithCatalogUser({\n          annotations: {\n            'okta.com/email': profile.email,\n          },\n        });\n      };\n    },\n  });\n}\n","/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  commonSignInResolvers,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { oktaAuthenticator } from './authenticator';\nimport { oktaSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleOktaProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'okta-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        providers: authProvidersExtensionPoint,\n      },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'okta',\n          factory: createOAuthProviderFactory({\n            authenticator: oktaAuthenticator,\n            signInResolverFactories: {\n              ...oktaSignInResolvers,\n              ...commonSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","OktaStrategy","oktaSignInResolvers","createSignInResolverFactory","createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","commonSignInResolvers"],"mappings":";;;;;;;;AAyBO,MAAM,oBAAoBA,uCAAyB,CAAA;AAAA,EACxD,yBACEC,+CAAiC,CAAA,uBAAA;AAAA,EACnC,UAAW,CAAA,EAAE,WAAa,EAAA,MAAA,EAAU,EAAA;AAClC,IAAM,MAAA,QAAA,GAAW,MAAO,CAAA,SAAA,CAAU,UAAU,CAAA,CAAA;AAC5C,IAAM,MAAA,YAAA,GAAe,MAAO,CAAA,SAAA,CAAU,cAAc,CAAA,CAAA;AACpD,IAAA,MAAM,QAAW,GAAA,MAAA,CAAO,iBAAkB,CAAA,UAAU,CAAK,IAAA,kBAAA,CAAA;AACzD,IAAM,MAAA,YAAA,GAAe,MAAO,CAAA,iBAAA,CAAkB,cAAc,CAAA,CAAA;AAC5D,IAAM,MAAA,GAAA,GAAM,MAAO,CAAA,iBAAA,CAAkB,KAAK,CAAA,CAAA;AAG1C,IAAA,MAAM,aAAgB,GAAA,sBAAA,CAAA;AAEtB,IAAA,MAAM,gBAAmB,GAAA,MAAA,CAAO,iBAAkB,CAAA,kBAAkB,CAAK,IAAA,EAAA,CAAA;AAEzE,IAAM,MAAA,mBAAA,GAAsB,CAAC,OAAA,EAAiB,OAAoB,KAAA;AAChE,MAAM,MAAA,YAAA,GAAe,OAAQ,CAAA,KAAA,CAAM,GAAG,CAAA,CAAA;AACtC,MAAM,MAAA,YAAA,GAAe,OAAQ,CAAA,KAAA,CAAM,GAAG,CAAA,CAAA;AACtC,MAAM,MAAA,cAAA,uBAAqB,GAAI,CAAA,CAAC,GAAG,YAAc,EAAA,GAAG,YAAY,CAAC,CAAA,CAAA;AACjE,MAAA,OAAO,KAAM,CAAA,IAAA,CAAK,cAAc,CAAA,CAAE,KAAK,GAAG,CAAA,CAAA;AAAA,KAC5C,CAAA;AACA,IAAM,MAAA,KAAA,GAAQ,mBAAoB,CAAA,aAAA,EAAe,gBAAgB,CAAA,CAAA;AAEjE,IAAA,OAAOA,+CAAiC,CAAA,IAAA;AAAA,MACtC,IAAIC,0BAAA;AAAA,QACF;AAAA,UACE,QAAU,EAAA,QAAA;AAAA,UACV,YAAA;AAAA,UACA,WAAa,EAAA,WAAA;AAAA,UACb,QAAA;AAAA,UACA,YAAc,EAAA,YAAA;AAAA,UACd,GAAA;AAAA,UACA,iBAAmB,EAAA,KAAA;AAAA,UACnB,aAAe,EAAA,MAAA;AAAA,UACf,KAAA;AAAA,SACF;AAAA,QACA,CACE,WAAA,EACA,YACA,EAAA,MAAA,EACA,aACA,IACG,KAAA;AACH,UAAA,IAAA;AAAA,YACE,KAAA,CAAA;AAAA,YACA,EAAE,WAAa,EAAA,MAAA,EAAQ,WAAY,EAAA;AAAA,YACnC,EAAE,YAAa,EAAA;AAAA,WACjB,CAAA;AAAA,SACF;AAAA,OACF;AAAA,KACF,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,KAAM,CAAA,KAAA,EAAO,MAAQ,EAAA;AACzB,IAAO,OAAA,MAAA,CAAO,MAAM,KAAO,EAAA;AAAA,MACzB,UAAY,EAAA,SAAA;AAAA,MACZ,MAAQ,EAAA,SAAA;AAAA,KACT,CAAA,CAAA;AAAA,GACH;AAAA,EAEA,MAAM,YAAa,CAAA,KAAA,EAAO,MAAQ,EAAA;AAChC,IAAO,OAAA,MAAA,CAAO,aAAa,KAAK,CAAA,CAAA;AAAA,GAClC;AAAA,EAEA,MAAM,OAAQ,CAAA,KAAA,EAAO,MAAQ,EAAA;AAC3B,IAAO,OAAA,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAA;AAAA,GAC7B;AACF,CAAC;;AChEgBC,qCAAA;AAAA,CAAV,CAAUA,oBAAV,KAAA;AAKE,EAAMA,oBAAAA,CAAA,oCAAoCC,0CAA4B,CAAA;AAAA,IAC3E,MAAS,GAAA;AACP,MAAO,OAAA,OACL,MACA,GACG,KAAA;AACH,QAAM,MAAA,EAAE,SAAY,GAAA,IAAA,CAAA;AAEpB,QAAI,IAAA,CAAC,QAAQ,KAAO,EAAA;AAClB,UAAM,MAAA,IAAI,MAAM,iCAAiC,CAAA,CAAA;AAAA,SACnD;AAEA,QAAA,OAAO,IAAI,qBAAsB,CAAA;AAAA,UAC/B,WAAa,EAAA;AAAA,YACX,kBAAkB,OAAQ,CAAA,KAAA;AAAA,WAC5B;AAAA,SACD,CAAA,CAAA;AAAA,OACH,CAAA;AAAA,KACF;AAAA,GACD,CAAA,CAAA;AAAA,CAxBc,EAAAD,2BAAA,KAAAA,2BAAA,GAAA,EAAA,CAAA,CAAA;;ACHV,MAAM,yBAAyBE,oCAAoB,CAAA;AAAA,EACxD,QAAU,EAAA,MAAA;AAAA,EACV,QAAU,EAAA,eAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,SAAW,EAAAC,0CAAA;AAAA,OACb;AAAA,MACA,MAAM,IAAA,CAAK,EAAE,SAAA,EAAa,EAAA;AACxB,QAAA,SAAA,CAAU,gBAAiB,CAAA;AAAA,UACzB,UAAY,EAAA,MAAA;AAAA,UACZ,SAASC,yCAA2B,CAAA;AAAA,YAClC,aAAe,EAAA,iBAAA;AAAA,YACf,uBAAyB,EAAA;AAAA,cACvB,GAAGJ,2BAAA;AAAA,cACH,GAAGK,oCAAA;AAAA,aACL;AAAA,WACD,CAAA;AAAA,SACF,CAAA,CAAA;AAAA,OACH;AAAA,KACD,CAAA,CAAA;AAAA,GACH;AACF,CAAC;;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+import * as _backstage_plugin_auth_node from '@backstage/plugin-auth-node';
+import { PassportOAuthAuthenticatorHelper, PassportProfile, OAuthAuthenticatorResult } from '@backstage/plugin-auth-node';
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+
+/** @public */
+declare const oktaAuthenticator: _backstage_plugin_auth_node.OAuthAuthenticator<PassportOAuthAuthenticatorHelper, PassportProfile>;
+
+/** @public */
+declare const authModuleOktaProvider: () => _backstage_backend_plugin_api.BackendFeature;
+
+/**
+ * Available sign-in resolvers for the Okta auth provider.
+ *
+ * @public
+ */
+declare namespace oktaSignInResolvers {
+    /**
+     * Looks up the user by matching their Okta   email to the entity email.
+     */
+    const emailMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<OAuthAuthenticatorResult<PassportProfile>, unknown>;
+}
+
+export { authModuleOktaProvider as default, oktaAuthenticator, oktaSignInResolvers };

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@backstage/plugin-auth-backend-module-okta-provider",
+  "description": "The okta-provider backend module for the auth plugin.",
+  "version": "0.0.0-nightly-20231121021721",
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "backstage": {
+    "role": "backend-plugin-module"
+  },
+  "scripts": {
+    "start": "backstage-cli package start",
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "clean": "backstage-cli package clean",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack"
+  },
+  "dependencies": {
+    "@backstage/backend-common": "^0.0.0-nightly-20231121021721",
+    "@backstage/backend-plugin-api": "^0.0.0-nightly-20231121021721",
+    "@backstage/plugin-auth-node": "^0.0.0-nightly-20231121021721",
+    "@davidzemon/passport-okta-oauth": "^0.0.5",
+    "express": "^4.18.2",
+    "passport": "^0.6.0"
+  },
+  "devDependencies": {
+    "@backstage/backend-defaults": "^0.0.0-nightly-20231121021721",
+    "@backstage/backend-test-utils": "^0.0.0-nightly-20231121021721",
+    "@backstage/cli": "^0.0.0-nightly-20231121021721",
+    "@backstage/plugin-auth-backend": "^0.0.0-nightly-20231121021721",
+    "supertest": "^6.3.3"
+  },
+  "configSchema": "config.d.ts",
+  "files": [
+    "dist",
+    "config.d.ts"
+  ]
+}