@backstage/plugin-auth-backend 0.13.1-next.1 → 0.14.1-next.0

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # @backstage/plugin-auth-backend
 
+## 0.14.1-next.0
+
+### Patch Changes
+
+- f6aae90e4e: Added configurable algorithm field for TokenFactory
+- Updated dependencies
+  - @backstage/backend-common@0.13.6-next.0
+  - @backstage/plugin-auth-node@0.2.2-next.0
+
+## 0.14.0
+
+### Minor Changes
+
+- 2df2f01a29: Removed the explicit `disableRefresh` option from `OAuthAdapter`. Refresh can still be disabled for a provider by not implementing the `refresh` method.
+
+### Patch Changes
+
+- cac3ba68a2: Fixed a bug that was introduced in `0.13.1-next.0` which caused the `ent` claim of issued tokens to be dropped.
+- 5d268623dd: Updates the OAuth2 Proxy provider to require less infrastructure configuration.
+
+  The auth result object of the OAuth2 Proxy now provides access to the request headers, both through the `headers` object as well as `getHeader` method. The existing logic that parses and extracts the user information from ID tokens is deprecated and will be removed in a future release. See the OAuth2 Proxy provider documentation for more details.
+
+  The OAuth2 Proxy provider now also has a default `authHandler` implementation that reads the display name and email from the incoming request headers.
+
+- 2df2f01a29: The Auth0 adapter no longer disables session refreshing.
+- cfc0f19699: Updated dependency `fs-extra` to `10.1.0`.
+- 787ae0d541: Add more common predefined sign-in resolvers to auth providers.
+
+  Add the existing resolver to more providers (already available at `google`):
+
+  - `providers.microsoft.resolvers.emailLocalPartMatchingUserEntityName()`
+  - `providers.okta.resolvers.emailLocalPartMatchingUserEntityName()`
+
+  Add a new resolver for simple email-to-email matching:
+
+  - `providers.google.resolvers.emailMatchingUserEntityProfileEmail()`
+  - `providers.microsoft.resolvers.emailMatchingUserEntityProfileEmail()`
+  - `providers.okta.resolvers.emailMatchingUserEntityProfileEmail()`
+
+- 9ec4e0613e: Update to `jose` 4.6.0
+- Updated dependencies
+  - @backstage/backend-common@0.13.3
+  - @backstage/config@1.0.1
+  - @backstage/plugin-auth-node@0.2.1
+  - @backstage/catalog-client@1.0.2
+  - @backstage/catalog-model@1.0.2
+
+## 0.13.1-next.2
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.13.3-next.2
+  - @backstage/config@1.0.1-next.0
+  - @backstage/catalog-model@1.0.2-next.0
+  - @backstage/plugin-auth-node@0.2.1-next.1
+  - @backstage/catalog-client@1.0.2-next.0
+
 ## 0.13.1-next.1
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -26,9 +26,9 @@ var passportOneloginOauth = require('passport-onelogin-oauth');
 var passportSaml = require('passport-saml');
 var googleAuthLibrary = require('google-auth-library');
 var catalogClient = require('@backstage/catalog-client');
-var uuid = require('uuid');
-var luxon = require('luxon');
 var catalogModel = require('@backstage/catalog-model');
+var luxon = require('luxon');
+var uuid = require('uuid');
 var backendCommon = require('@backstage/backend-common');
 var firestore = require('@google-cloud/firestore');
 var lodash = require('lodash');
@@ -367,7 +367,7 @@ class OAuthAdapter {
         this.setGrantedScopeCookie(res, state.scope);
         response.providerInfo.scope = state.scope;
       }
-      if (refreshToken && !this.options.disableRefresh) {
+      if (refreshToken) {
         this.setRefreshTokenCookie(res, refreshToken);
       }
       const identity = await this.populateIdentity(response.backstageIdentity);
@@ -395,7 +395,7 @@ class OAuthAdapter {
     if (!ensuresXRequestedWith(req)) {
       throw new errors.AuthenticationError("Invalid X-Requested-With header");
     }
-    if (!this.handlers.refresh || this.options.disableRefresh) {
+    if (!this.handlers.refresh) {
       throw new errors.InputError(`Refresh token is not supported for provider ${this.options.providerId}`);
     }
     try {
@@ -752,7 +752,6 @@ const auth0 = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: true,
         providerId,
         callbackUrl
       });
@@ -964,7 +963,6 @@ const bitbucket = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -1236,7 +1234,6 @@ const gitlab = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -1355,7 +1352,6 @@ const google = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -1486,7 +1482,6 @@ const microsoft = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -1515,9 +1510,11 @@ const microsoftEmailSignInResolver = microsoft.resolvers.emailMatchingUserEntity
 
 class OAuth2AuthProvider {
   constructor(options) {
+    var _a;
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
+    this.disableRefresh = (_a = options.disableRefresh) != null ? _a : false;
     this._strategy = new OAuth2Strategy.Strategy({
       clientID: options.clientId,
       clientSecret: options.clientSecret,
@@ -1556,6 +1553,9 @@ class OAuth2AuthProvider {
     };
   }
   async refresh(req) {
+    if (this.disableRefresh) {
+      throw new errors.InputError("Session refreshes have been disabled");
+    }
     const refreshTokenResponse = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
     const { accessToken, params, refreshToken } = refreshTokenResponse;
     const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
@@ -1617,10 +1617,10 @@ const oauth2 = createAuthProviderIntegration({
         tokenUrl,
         scope,
         includeBasicAuth,
-        resolverContext
+        resolverContext,
+        disableRefresh
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh,
         providerId,
         callbackUrl
       });
@@ -1820,7 +1820,6 @@ const oidc = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -1933,7 +1932,6 @@ const okta = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -2051,7 +2049,6 @@ const onelogin = createAuthProviderIntegration({
         resolverContext
       });
       return OAuthAdapter.fromConfig(globalConfig, provider, {
-        disableRefresh: false,
         providerId,
         callbackUrl
       });
@@ -2303,10 +2300,12 @@ function createOidcRouter(options) {
 const MS_IN_S = 1e3;
 class TokenFactory {
   constructor(options) {
+    var _a;
     this.issuer = options.issuer;
     this.logger = options.logger;
     this.keyStore = options.keyStore;
     this.keyDurationSeconds = options.keyDurationSeconds;
+    this.algorithm = (_a = options.algorithm) != null ? _a : "ES256";
   }
   async issueToken(params) {
     const key = await this.getKey();
@@ -2362,11 +2361,11 @@ class TokenFactory {
       seconds: this.keyDurationSeconds
     }).toJSDate();
     const promise = (async () => {
-      const key = await jose.generateKeyPair("ES256");
+      const key = await jose.generateKeyPair(this.algorithm);
       const publicKey = await jose.exportJWK(key.publicKey);
       const privateKey = await jose.exportJWK(key.privateKey);
       publicKey.kid = privateKey.kid = uuid.v4();
-      publicKey.alg = privateKey.alg = "ES256";
+      publicKey.alg = privateKey.alg = this.algorithm;
       this.logger.info(`Created new signing key ${publicKey.kid}`);
       await this.keyStore.addKey(publicKey);
       return privateKey;