@backstage/plugin-auth-backend 0.0.0-nightly-20240403021132 → 0.0.0-nightly-20240404021212

package/CHANGELOG.md

@@ -1,30 +1,31 @@
 # @backstage/plugin-auth-backend
 
-## 0.0.0-nightly-20240403021132
-
-### Patch Changes
-
-- Updated dependencies
-  - @backstage/backend-common@0.0.0-nightly-20240403021132
-  - @backstage/backend-plugin-api@0.0.0-nightly-20240403021132
+## 0.0.0-nightly-20240404021212
+
+### Patch Changes
+
+- d62bc51: Added token type header parameter and user identity proof to issued user tokens.
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-aws-alb-provider@0.0.0-nightly-20240404021212
+  - @backstage/backend-common@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-atlassian-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-github-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-gitlab-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-google-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-microsoft-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-oauth2-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-oidc-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-okta-provider@0.0.0-nightly-20240404021212
+  - @backstage/backend-plugin-api@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-gcp-iap-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-auth-backend-module-oauth2-proxy-provider@0.0.0-nightly-20240404021212
+  - @backstage/plugin-catalog-node@0.0.0-nightly-20240404021212
   - @backstage/catalog-client@1.6.3
   - @backstage/catalog-model@1.4.5
   - @backstage/config@1.2.0
   - @backstage/errors@1.2.4
   - @backstage/types@1.1.1
-  - @backstage/plugin-auth-backend-module-atlassian-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-aws-alb-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-gcp-iap-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-github-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-gitlab-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-google-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-microsoft-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-oauth2-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-oauth2-proxy-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-oidc-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-backend-module-okta-provider@0.0.0-nightly-20240403021132
-  - @backstage/plugin-auth-node@0.0.0-nightly-20240403021132
-  - @backstage/plugin-catalog-node@0.0.0-nightly-20240403021132
 
 ## 0.22.4-next.0
 

package/dist/index.cjs.js

@@ -2225,8 +2225,8 @@ class TokenFactory {
   async issueToken(params) {
     const key = await this.getKey();
     const iss = this.issuer;
-    const { sub, ent, ...additionalClaims } = params.claims;
-    const aud = "backstage";
+    const { sub, ent = [sub], ...additionalClaims } = params.claims;
+    const aud = pluginAuthNode.tokenTypes.user.audClaim;
     const iat = Math.floor(Date.now() / MS_IN_S$1);
     const exp = iat + this.keyDurationSeconds;
     try {
@@ -2236,12 +2236,35 @@ class TokenFactory {
         '"sub" claim provided by the auth resolver is not a valid EntityRef.'
       );
     }
-    this.logger.info(`Issuing token for ${sub}, with entities ${ent != null ? ent : []}`);
     if (!key.alg) {
       throw new errors.AuthenticationError("No algorithm was provided in the key");
     }
-    const claims = { ...additionalClaims, iss, sub, ent, aud, iat, exp };
-    const token = await new jose.SignJWT(claims).setProtectedHeader({ alg: key.alg, kid: key.kid }).setIssuer(iss).setAudience(aud).setSubject(sub).setIssuedAt(iat).setExpirationTime(exp).sign(await jose.importJWK(key));
+    this.logger.info(`Issuing token for ${sub}, with entities ${ent}`);
+    const signingKey = await jose.importJWK(key);
+    const uip = await this.createUserIdentityClaim({
+      header: {
+        typ: pluginAuthNode.tokenTypes.limitedUser.typParam,
+        alg: key.alg,
+        kid: key.kid
+      },
+      payload: { sub, ent, iat, exp },
+      key: signingKey
+    });
+    const claims = {
+      ...additionalClaims,
+      iss,
+      sub,
+      ent,
+      aud,
+      iat,
+      exp,
+      uip
+    };
+    const token = await new jose.SignJWT(claims).setProtectedHeader({
+      typ: pluginAuthNode.tokenTypes.user.typParam,
+      alg: key.alg,
+      kid: key.kid
+    }).sign(signingKey);
     if (token.length > MAX_TOKEN_LENGTH) {
       throw new Error(
         `Failed to issue a new user token. The resulting token is excessively large, with either too many ownership claims or too large custom claims. You likely have a bug either in the sign-in resolver or catalog data. The following claims were requested: '${JSON.stringify(
@@ -2308,6 +2331,26 @@ class TokenFactory {
     }
     return promise;
   }
+  // Creates a string claim that can be used as part of reconstructing a limited
+  // user token. The output of this function is only the signature part of a
+  // JWS.
+  async createUserIdentityClaim(options) {
+    const header = {
+      typ: options.header.typ,
+      alg: options.header.alg,
+      ...options.header.kid ? { kid: options.header.kid } : {}
+    };
+    const payload = {
+      sub: options.payload.sub,
+      ent: options.payload.ent,
+      iat: options.payload.iat,
+      exp: options.payload.exp
+    };
+    const jws = await new jose.GeneralSign(
+      new TextEncoder().encode(JSON.stringify(payload))
+    ).addSignature(options.key).setProtectedHeader(header).done().sign();
+    return jws.signatures[0].signature;
+  }
 }
 
 const TABLE = "signing_keys";