@backstage/plugin-auth-backend 0.0.0-nightly-202201921950 → 0.0.0-nightly-202203121954

package/CHANGELOG.md

@@ -1,6 +1,50 @@
 # @backstage/plugin-auth-backend
 
-## 0.0.0-nightly-202201921950
+## 0.0.0-nightly-202203121954
+
+### Minor Changes
+
+- cef64b1561: **BREAKING** Added `tokenManager` as a required property for the auth-backend `createRouter` function. This dependency is used to issue server tokens that are used by the `CatalogIdentityClient` when looking up users and their group membership during authentication.
+
+  These changes are **required** to `packages/backend/src/plugins/auth.ts`:
+
+  ```diff
+  export default async function createPlugin({
+    logger,
+    database,
+    config,
+    discovery,
+  + tokenManager,
+  }: PluginEnvironment): Promise<Router> {
+    return await createRouter({
+      logger,
+      config,
+      database,
+      discovery,
+  +   tokenManager,
+    });
+  }
+  ```
+
+  **BREAKING** The `CatalogIdentityClient` constructor now expects a `TokenManager` instead of a `TokenIssuer`. The `TokenManager` interface is used to generate a server token when [resolving a user's identity and membership through the catalog](https://backstage.io/docs/auth/identity-resolver). Using server tokens for these requests allows the auth-backend to bypass authorization checks when permissions are enabled for Backstage. This change will break apps that rely on the user tokens that were previously used by the client. Refer to the ["Backend-to-backend Authentication" tutorial](https://backstage.io/docs/tutorials/backend-to-backend-auth) for more information on server token usage.
+
+### Patch Changes
+
+- 28a5f9d0b1: chore(deps): bump `passport` from 0.4.1 to 0.5.2
+
+## 0.8.0
+
+### Minor Changes
+
+- 67349916ac: The `sub` claim in Backstage tokens generated by the default Google and OIDC sign-in resolvers are now full entity references of the format `<kind>:<namespace>/<name>`.
+
+### Patch Changes
+
+- 033493a8af: Running the `auth-backend` on multiple domains, perhaps different domains depending on the `auth.environment`, was previously not possible as the `domain` name of the cookie was taken from `backend.baseUrl`. This prevented any cookies to be set in the start of the auth flow as the domain of the cookie would not match the domain of the callbackUrl configured in the OAuth app. This change checks if a provider supports custom `callbackUrl`'s to be configured in the application configuration and uses the domain from that, allowing the `domain`'s to match and the cookie to be set.
+- Updated dependencies
+  - @backstage/backend-common@0.10.5
+
+## 0.7.0
 
 ### Minor Changes
 
@@ -9,13 +53,17 @@
   **BREAKING** The `AuthHandler` requires now an `AuthResolverContext` parameter. This aligns with the
   behavior of the `SignInResolver`.
 
+- f8496730ab: Switched the handling of the `BackstageIdentityResponse` so that the returned `identity.userEntityRef` is always a full entity reference. If `userEntityRef` was previously set to `jane`, it will now be `user:default/jane`. The `userEntityRef` in the response is parsed from the `sub` claim in the payload of the Backstage token.
+- a53d7d8143: Update provider subs to return full entity ref.
+
 ### Patch Changes
 
+- f815b7e4a4: build(deps): bump `@google-cloud/firestore` from 4.15.1 to 5.0.2
 - Updated dependencies
-  - @backstage/backend-common@0.0.0-nightly-202201921950
-  - @backstage/config@0.0.0-nightly-202201921950
-  - @backstage/catalog-model@0.0.0-nightly-202201921950
-  - @backstage/catalog-client@0.0.0-nightly-202201921950
+  - @backstage/backend-common@0.10.4
+  - @backstage/config@0.1.13
+  - @backstage/catalog-model@0.9.10
+  - @backstage/catalog-client@0.5.5
 
 ## 0.7.0-next.0
 

package/dist/index.cjs.js

@@ -149,6 +149,16 @@ const verifyNonce = (req, providerId) => {
     throw new Error("Invalid nonce");
   }
 };
+const getCookieConfig = (authUrl, providerId) => {
+  const { hostname: cookieDomain, pathname, protocol } = authUrl;
+  const secure = protocol === "https:";
+  const cookiePath = pathname.endsWith(`${providerId}/handler/frame`) ? pathname.slice(0, -"/handler/frame".length) : `${pathname}/${providerId}`;
+  return {
+    cookieDomain,
+    cookiePath,
+    secure
+  };
+};
 
 class OAuthEnvironmentHandler {
   constructor(handlers) {
@@ -245,6 +255,10 @@ function parseJwtPayload(token) {
 }
 function prepareBackstageIdentityResponse(result) {
   const { sub, ent } = parseJwtPayload(result.token);
+  const userEntityRef = catalogModel.stringifyEntityRef(catalogModel.parseEntityRef(sub, {
+    defaultKind: "user",
+    defaultNamespace: catalogModel.ENTITY_DEFAULT_NAMESPACE
+  }));
   return {
     ...{
       idToken: result.token,
@@ -252,7 +266,7 @@ function prepareBackstageIdentityResponse(result) {
     },
     identity: {
       type: "user",
-      userEntityRef: sub,
+      userEntityRef,
       ownershipEntityRefs: ent != null ? ent : []
     }
   };
@@ -309,14 +323,14 @@ class OAuthAdapter {
     };
   }
   static fromConfig(config, handlers, options) {
+    var _a;
     const { origin: appOrigin } = new url.URL(config.appUrl);
-    const secure = config.baseUrl.startsWith("https://");
-    const url$1 = new url.URL(config.baseUrl);
-    const cookiePath = `${url$1.pathname}/${options.providerId}`;
+    const authUrl = new url.URL((_a = options.callbackUrl) != null ? _a : config.baseUrl);
+    const { cookieDomain, cookiePath, secure } = getCookieConfig(authUrl, options.providerId);
     return new OAuthAdapter(handlers, {
       ...options,
       appOrigin,
-      cookieDomain: url$1.hostname,
+      cookieDomain,
       cookiePath,
       secure,
       isOriginAllowed: config.isOriginAllowed
@@ -546,7 +560,7 @@ const executeFetchUserProfileStrategy = async (providerStrategy, accessToken) =>
 class CatalogIdentityClient {
   constructor(options) {
     this.catalogApi = options.catalogApi;
-    this.tokenIssuer = options.tokenIssuer;
+    this.tokenManager = options.tokenManager;
   }
   async findUser(query) {
     const filter = {
@@ -555,9 +569,7 @@ class CatalogIdentityClient {
     for (const [key, value] of Object.entries(query.annotations)) {
       filter[`metadata.annotations.${key}`] = value;
     }
-    const token = await this.tokenIssuer.issueToken({
-      claims: { sub: "backstage.io/auth-backend" }
-    });
+    const { token } = await this.tokenManager.getToken();
     const { items } = await this.catalogApi.getEntities({ filter }, { token });
     if (items.length !== 1) {
       if (items.length > 1) {
@@ -587,7 +599,8 @@ class CatalogIdentityClient {
       "metadata.namespace": ref.namespace,
       "metadata.name": ref.name
     }));
-    const entities = await this.catalogApi.getEntities({ filter }).then((r) => r.items);
+    const { token } = await this.tokenManager.getToken();
+    const entities = await this.catalogApi.getEntities({ filter }, { token }).then((r) => r.items);
     if (entityRefs.length !== entities.length) {
       const foundEntityNames = entities.map(catalogModel.stringifyEntityRef);
       const missingEntityNames = resolvedEntityRefs.map(catalogModel.stringifyEntityRef).filter((s) => !foundEntityNames.includes(s));
@@ -697,6 +710,7 @@ const createAtlassianProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -707,7 +721,7 @@ const createAtlassianProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (_a = options == null ? void 0 : options.authHandler) != null ? _a : atlassianDefaultAuthHandler;
     const provider = new AtlassianAuthProvider({
@@ -832,6 +846,7 @@ const createAuth0Provider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -842,7 +857,7 @@ const createAuth0Provider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -970,7 +985,7 @@ class AwsAlbAuthProvider {
   }
 }
 const createAwsAlbProvider = (options) => {
-  return ({ config, tokenIssuer, catalogApi, logger }) => {
+  return ({ config, tokenIssuer, catalogApi, logger, tokenManager }) => {
     const region = config.getString("region");
     const issuer = config.getOptionalString("iss");
     if ((options == null ? void 0 : options.signIn.resolver) === void 0) {
@@ -978,7 +993,7 @@ const createAwsAlbProvider = (options) => {
     }
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
       profile: makeProfileInfo(fullProfile)
@@ -1106,6 +1121,7 @@ const createBitbucketProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1115,7 +1131,7 @@ const createBitbucketProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -1211,7 +1227,10 @@ const githubDefaultSignInResolver = async (info, ctx) => {
   const { fullProfile } = info.result;
   const userId = fullProfile.username || fullProfile.id;
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`]
+    }
   });
   return { id: userId, token };
 };
@@ -1221,6 +1240,7 @@ const createGithubProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1235,7 +1255,7 @@ const createGithubProvider = (options) => {
     const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
       profile: makeProfileInfo(fullProfile)
@@ -1266,7 +1286,8 @@ const createGithubProvider = (options) => {
     return OAuthAdapter.fromConfig(globalConfig, provider, {
       persistScopes: true,
       providerId,
-      tokenIssuer
+      tokenIssuer,
+      callbackUrl
     });
   });
 };
@@ -1278,7 +1299,7 @@ const gitlabDefaultSignInResolver = async (info, ctx) => {
     id = profile.email.split("@")[0];
   }
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: id, ent: [`user:default/${id}`] }
+    claims: { sub: `user:default/${id}`, ent: [`user:default/${id}`] }
   });
   return { id, token };
 };
@@ -1362,6 +1383,7 @@ const createGitlabProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1373,7 +1395,7 @@ const createGitlabProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (_a = options == null ? void 0 : options.authHandler) != null ? _a : gitlabDefaultAuthHandler;
     const signInResolverFn = (_c = (_b = options == null ? void 0 : options.signIn) == null ? void 0 : _b.resolver) != null ? _c : gitlabDefaultSignInResolver;
@@ -1508,7 +1530,7 @@ const googleDefaultSignInResolver = async (info, ctx) => {
     userId = profile.email.split("@")[0];
   }
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }
   });
   return { id: userId, token };
 };
@@ -1518,6 +1540,7 @@ const createGoogleProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1527,7 +1550,7 @@ const createGoogleProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -1662,7 +1685,10 @@ const microsoftDefaultSignInResolver = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`]
+    }
   });
   return { id: userId, token };
 };
@@ -1672,6 +1698,7 @@ const createMicrosoftProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1684,7 +1711,7 @@ const createMicrosoftProvider = (options) => {
     const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -1807,7 +1834,7 @@ const oAuth2DefaultSignInResolver$1 = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }
   });
   return { id: userId, token };
 };
@@ -1817,6 +1844,7 @@ const createOAuth2Provider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -1831,7 +1859,7 @@ const createOAuth2Provider = (options) => {
     const disableRefresh = (_a = envConfig.getOptionalBoolean("disableRefresh")) != null ? _a : false;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -2262,12 +2290,12 @@ class Oauth2ProxyAuthProvider {
     };
   }
 }
-const createOauth2ProxyProvider = (options) => ({ catalogApi, logger, tokenIssuer }) => {
+const createOauth2ProxyProvider = (options) => ({ catalogApi, logger, tokenIssuer, tokenManager }) => {
   const signInResolver = options.signIn.resolver;
   const authHandler = options.authHandler;
   const catalogIdentityClient = new CatalogIdentityClient({
     catalogApi,
-    tokenIssuer
+    tokenManager
   });
   return new Oauth2ProxyAuthProvider({
     logger,
@@ -2378,7 +2406,10 @@ const oAuth2DefaultSignInResolver = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`]
+    }
   });
   return { id: userId, token };
 };
@@ -2388,6 +2419,7 @@ const createOidcProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -2401,7 +2433,7 @@ const createOidcProvider = (options) => {
     const prompt = envConfig.getOptionalString("prompt");
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ userinfo }) => ({
       profile: {
@@ -2545,7 +2577,7 @@ const oktaDefaultSignInResolver = async (info, ctx) => {
   }
   const userId = profile.email.split("@")[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] }
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] }
   });
   return { id: userId, token };
 };
@@ -2555,6 +2587,7 @@ const createOktaProvider = (_options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -2568,7 +2601,7 @@ const createOktaProvider = (_options) => {
     }
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (_options == null ? void 0 : _options.authHandler) ? _options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -2688,6 +2721,7 @@ const createOneLoginProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => OAuthEnvironmentHandler.mapConfig(config, (envConfig) => {
@@ -2698,7 +2732,7 @@ const createOneLoginProvider = (options) => {
     const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile, params }) => ({
       profile: makeProfileInfo(fullProfile, params.id_token)
@@ -2788,13 +2822,14 @@ const createSamlProvider = (options) => {
     globalConfig,
     config,
     tokenIssuer,
+    tokenManager,
     catalogApi,
     logger
   }) => {
     var _a, _b;
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
       profile: {
@@ -2902,7 +2937,7 @@ class GcpIapProvider {
   }
 }
 function createGcpIapProvider(options) {
-  return ({ config, tokenIssuer, catalogApi, logger }) => {
+  return ({ config, tokenIssuer, catalogApi, logger, tokenManager }) => {
     var _a;
     const audience = config.getString("audience");
     const authHandler = (_a = options.authHandler) != null ? _a : defaultAuthHandler;
@@ -2910,7 +2945,7 @@ function createGcpIapProvider(options) {
     const tokenValidator = createTokenValidator(audience);
     const catalogIdentityClient = new CatalogIdentityClient({
       catalogApi,
-      tokenIssuer
+      tokenManager
     });
     return new GcpIapProvider({
       authHandler,
@@ -2940,7 +2975,14 @@ const factories = {
 };
 
 async function createRouter(options) {
-  const { logger, config, discovery, database, providerFactories } = options;
+  const {
+    logger,
+    config,
+    discovery,
+    database,
+    tokenManager,
+    providerFactories
+  } = options;
   const router = Router__default["default"]();
   const appUrl = config.getString("app.baseUrl");
   const authUrl = await discovery.getExternalBaseUrl("auth");
@@ -2986,6 +3028,7 @@ async function createRouter(options) {
           globalConfig: { baseUrl: authUrl, appUrl, isOriginAllowed },
           config: providersConfig.getConfig(providerId),
           logger,
+          tokenManager,
           tokenIssuer,
           discovery,
           catalogApi