@backstage/plugin-auth-backend 0.18.1-next.2 → 0.18.2-next.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @backstage/plugin-auth-backend
 
+## 0.18.2-next.0
+
+### Patch Changes
+
+- d8f774c30df: Enforce the secret visibility of certificates and client secrets in the auth backend. Also, document all known options for each auth plugin.
+- 7908d72e033: Introduce a new global config parameter, `auth.enableExperimentalRedirectFlow`. When enabled, auth will happen with an in-window redirect flow rather than through a popup window.
+- Updated dependencies
+  - @backstage/backend-common@0.18.4-next.0
+  - @backstage/config@1.0.7
+  - @backstage/catalog-client@1.4.0
+  - @backstage/catalog-model@1.2.1
+  - @backstage/errors@1.1.5
+  - @backstage/types@1.0.2
+  - @backstage/plugin-auth-node@0.2.13-next.0
+
+## 0.18.1
+
+### Patch Changes
+
+- e262738b8a0: Handle difference in expiration time between Microsoft session and Backstage session which caused the Backstage token to be invalid during a time frame.
+- 86cece2c1fb: Updated dependency `@types/passport-microsoft` to `^1.0.0`.
+- 52b0022dab7: Updated dependency `msw` to `^1.0.0`.
+- 529de8c4211: Added authentication provider for Azure Easy Authentication.
+- Updated dependencies
+  - @backstage/catalog-client@1.4.0
+  - @backstage/plugin-auth-node@0.2.12
+  - @backstage/backend-common@0.18.3
+  - @backstage/errors@1.1.5
+  - @backstage/catalog-model@1.2.1
+  - @backstage/config@1.0.7
+  - @backstage/types@1.0.2
+
 ## 0.18.1-next.2
 
 ### Patch Changes

package/config.d.ts

@@ -62,30 +62,72 @@ export interface Config {
      */
     providers?: {
       google?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          callbackUrl?: string;
+        };
       };
       github?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          callbackUrl?: string;
+          enterpriseInstanceUrl?: string;
+        };
       };
       gitlab?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          audience?: string;
+          callbackUrl?: string;
+        };
       };
       saml?: {
         entryPoint: string;
         logoutUrl?: string;
         issuer: string;
+        /**
+         * @visibility secret
+         */
         cert: string;
         audience?: string;
+        /**
+         * @visibility secret
+         */
         privateKey?: string;
         authnContext?: string[];
         identifierFormat?: string;
+        /**
+         * @visibility secret
+         */
         decryptionPvk?: string;
         signatureAlgorithm?: 'sha256' | 'sha512';
         digestAlgorithm?: string;
         acceptedClockSkewMs?: number;
       };
       okta?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          audience: string;
+          authServerId?: string;
+          idp?: string;
+          callbackUrl?: string;
+        };
       };
       oauth2?: {
         [authEnv: string]: {
@@ -101,19 +143,56 @@ export interface Config {
         };
       };
       oidc?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          callbackUrl?: string;
+          metadataUrl: string;
+          scope?: string;
+          prompt?: string;
+        };
       };
       auth0?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          domain: string;
+          callbackUrl?: string;
+          audience?: string;
+          connection?: string;
+          connectionScope?: string;
+        };
       };
       microsoft?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          tenantId: string;
+          callbackUrl?: string;
+        };
       };
       onelogin?: {
-        [authEnv: string]: { [key: string]: string };
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          issuer: string;
+          callbackUrl?: string;
+        };
       };
       awsalb?: {
-        issuer?: string;
+        iss?: string;
         region: string;
       };
       cfaccess?: {

package/dist/index.cjs.js

@@ -353,17 +353,19 @@ class OAuthAdapter {
     });
   }
   async start(req, res) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e, _f;
     const scope = (_b = (_a = req.query.scope) == null ? void 0 : _a.toString()) != null ? _b : "";
     const env = (_c = req.query.env) == null ? void 0 : _c.toString();
     const origin = (_d = req.query.origin) == null ? void 0 : _d.toString();
+    const redirectUrl = (_e = req.query.redirectUrl) == null ? void 0 : _e.toString();
+    const flow = (_f = req.query.flow) == null ? void 0 : _f.toString();
     if (!env) {
       throw new errors.InputError("No env provided in request query parameters");
     }
     const cookieConfig = this.getCookieConfig(origin);
     const nonce = crypto__default["default"].randomBytes(16).toString("base64");
     this.setNonceCookie(res, nonce, cookieConfig);
-    const state = { nonce, env, origin };
+    const state = { nonce, env, origin, redirectUrl, flow };
     if (this.options.persistScopes) {
       state.scope = scope;
     }
@@ -402,10 +404,19 @@ class OAuthAdapter {
         this.setRefreshTokenCookie(res, refreshToken, cookieConfig);
       }
       const identity = await this.populateIdentity(response.backstageIdentity);
-      return postMessageResponse(res, appOrigin, {
+      const responseObj = {
         type: "authorization_response",
         response: { ...response, backstageIdentity: identity }
-      });
+      };
+      if (state.flow === "redirect") {
+        if (!state.redirectUrl) {
+          throw new errors.InputError(
+            "No redirectUrl provided in request query parameters"
+          );
+        }
+        res.redirect(state.redirectUrl);
+      }
+      return postMessageResponse(res, appOrigin, responseObj);
     } catch (error) {
       const { name, message } = errors.isError(error) ? error : new Error("Encountered invalid error");
       return postMessageResponse(res, appOrigin, {
@@ -1436,7 +1447,7 @@ const gcpIap = createAuthProviderIntegration({
 });
 
 const ACCESS_TOKEN_PREFIX = "access-token.";
-const BACKSTAGE_SESSION_EXPIRATION = 3600;
+const BACKSTAGE_SESSION_EXPIRATION$1 = 3600;
 class GithubAuthProvider {
   constructor(options) {
     this.signInResolver = options.signInResolver;
@@ -1530,10 +1541,10 @@ class GithubAuthProvider {
       if (expiresInSeconds) {
         expiresInSeconds = Math.min(
           expiresInSeconds,
-          BACKSTAGE_SESSION_EXPIRATION
+          BACKSTAGE_SESSION_EXPIRATION$1
         );
       } else {
-        expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION;
+        expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION$1;
       }
     }
     return {
@@ -1858,6 +1869,7 @@ const google = createAuthProviderIntegration({
   }
 });
 
+const BACKSTAGE_SESSION_EXPIRATION = 3600;
 class MicrosoftAuthProvider {
   constructor(options) {
     this.signInResolver = options.signInResolver;
@@ -1914,12 +1926,13 @@ class MicrosoftAuthProvider {
     const photo = await this.getUserPhoto(result.accessToken);
     result.fullProfile.photos = photo ? [{ value: photo }] : void 0;
     const { profile } = await this.authHandler(result, this.resolverContext);
+    const expiresInSeconds = result.params.expires_in === void 0 ? BACKSTAGE_SESSION_EXPIRATION : Math.min(result.params.expires_in, BACKSTAGE_SESSION_EXPIRATION);
     const response = {
       providerInfo: {
         idToken: result.params.id_token,
         accessToken: result.accessToken,
         scope: result.params.scope,
-        expiresInSeconds: result.params.expires_in
+        expiresInSeconds
       },
       profile
     };