Adds Auth0 as IdP #1611

jaime-talkdesk · 2020-07-13T23:18:26Z

Hey, I just made a Pull Request!

Adds Auth0 for as Identity Provider to Sign In.

I ended up not using passport-auth0 since it's quite opinionated in the sense they have requirements around using request.session which is not being used in the other passport implementations, as well it's own nonce implementation. This would require to add express-session which I'm not sure if this is the way we want to go.

✔️ Checklist

All tests are passing yarn test
Screenshots attached (for UI changes)
Relevant documentation updated
Prettier run on changed files
Tests added for new functionality
Regression tests added for bug fixes

Rugvip

👍 to basing it off the passport-oauth2 strategy instead of the auth0 one.

As mentioned in a comment I'm wondering whether it makes sense to include OAuth here at all?

A future thing coming up is how to actually map this to users, but leaving that for later

Rugvip · 2020-07-14T08:00:28Z

packages/core-api/src/apis/implementations/auth/auth0/Auth0Auth.ts

+
+  constructor(private readonly sessionManager: SessionManager<Auth0Session>) {}
+
+  async getAccessToken(


Does it actually make sense to implement OAuth for auth0? Do they have their own APIs that you'd want to talk to? Otherwise I'm thinking we just stick to using it as a IdP only

I don't have that use case. It was more for someone to use if they wished so.

What are the bare minimum for the Idp? I would need OpenIdConnectApi but ProfileInfoApi, BackstageIdentityApi, SessionStateApi as well?

Bare minimum for providing a Backstage Identity for now would be ProfileInfoApi, BackstageIdentityApi, SessionStateApi. I think it might make sense to go with only that tbh, as afaik the access and ID tokens would be from the the actual provider used to log in to auth0, and at that point we likely want to stick to the purpose-built APIs we already have for that, e.g. googleAuthApi etc.

@Rugvip UserSettings's OIDCProviderSettings requires for the API Ref to extend OpenIdConnectApi. I think we should support at least OpenID/ID token since we might not have a dedicated API for some Idp that uses Auth0 supports.

If you prefer to remove it anyway, does it make sense to have it as a SignIn provider? I could me mixing up the concepts of Backstage identity and Open ID

Removed OAuthAPI.getaccessToken() in the meantime

The OIDCProviderSettings isn't part of the sign-in flow though, that's for OAuth, i.e. access delegation. A bit more info that here: https://github.com/spotify/backstage/blob/master/docs/auth/index.md#accessing-third-party-services.

Backstage Identity isn't fully settled yet, right now it's mostly there so that we can add some constraints to the implementation of auth providers that want to be used for sign-in. Either way the Backstage identity is a partial implementation of Open ID Connect. Looking at for example the Google provider, which implements both Open ID and Backstage Identity, you get two different ID Tokens, one that proves your Google identity, and one that proves your Backstage identity.

Rugvip · 2020-07-14T08:00:57Z

packages/core-api/src/apis/implementations/auth/auth0/Auth0Auth.ts

+import { Observable } from '../../../../types';
+
+type CreateOptions = {
+  // TODO(Following the words of Rugvip): These two should be grabbed from global config when available, they're not unique to Auth0Auth


Gonna try to get around to this after these PRs have landed 😅

JK :D, I can follow up this to clean it up

Rugvip · 2020-07-14T08:09:10Z

plugins/auth-backend/src/providers/auth0/strategy.ts

+    tokenParams(): object {
+        return {
+            'type': 'web_server',
+            'grant_type': 'client_credentials'


This confuses me, I assume we would've wanted authorization_code?

Yeah I assumed the same but they get the access token with that grant type 🤔 Example in their lib: https://github.com/auth0/passport-auth0/blob/096f789bea36a45a18d1a06accdd73decfb65131/lib/index.js#L143

Looks like it's hardcoded to authorization_code in the base strategy, so you could just leave it out here: https://github.com/jaredhanson/passport-oauth2/blob/e20f26aad60ed54f0e7952928cbb64979ef8da2b/lib/strategy.js#L167

Yes, it makes sense. I can test with authorization code to see if behaves according to the RFC

It works as expected. Wonder why their lib has client_credentials 🤷

soapraj · 2020-07-14T08:33:39Z

packages/core-api/src/apis/definitions/auth.ts

+  OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionStateApi & OpenIdConnectApi
+>({
+  id: 'core.auth.auth0',
+  description: 'Provides authentication towards Gitlab APIs',


the description needs to be updated

soapraj · 2020-07-14T08:38:32Z

plugins/auth-backend/src/providers/auth0/provider.ts

+    ) {
+      if (process.env.NODE_ENV !== 'development') {
+        throw new Error(
+          'Failed to initialize OAuth2 auth provider, set AUTH_OAUTH2_CLIENT_ID, AUTH_OAUTH2_CLIENT_SECRET, AUTH_OAUTH2_AUTH_URL, and AUTH_OAUTH2_TOKEN_URL env vars',


The env vars in the error and warning messages need to be updated.

soapraj · 2020-07-14T08:41:21Z

plugins/auth-backend/src/providers/auth0/provider.ts

+} from '../types';
+import OAuth2Strategy from 'passport-oauth2';
+
+interface OAuth0ProviderConfig {


rename OAuth0ProviderConfig -> Auth0ProviderConfig?

soapraj · 2020-07-14T08:41:47Z

plugins/auth-backend/src/providers/auth0/provider.ts

+  refreshToken: string;
+};
+
+export class OAuth2AuthProvider implements OAuthProviderHandlers {


rename OAuth2AuthProvider -> Auth0Provider?

packages/core/src/layout/Sidebar/UserSettings.tsx

Rugvip · 2020-08-12T07:06:41Z

Resolved conflicts with master. The auth config implementation has changed a bit since this was submitted, so we'll need to add auth0 back in the app-config.yaml

soapraj · 2020-08-12T07:19:30Z

Hey @jaime-talkdesk - looks like the backend parts need more fixes before this is good to go. We'll take a stab at it in the next couple of days.

Let us know if you want to take it up?

jaime-talkdesk · 2020-08-20T08:42:43Z

Hey @soapraj, thanks for completing the rest 🙏

jaime-talkdesk requested a review from a team as a code owner July 13, 2020 23:18

Rugvip reviewed Jul 14, 2020

View reviewed changes

soapraj reviewed Jul 14, 2020

View reviewed changes

jaime-talkdesk force-pushed the adds_auth0 branch 5 times, most recently from 0bf1895 to 21afcf8 Compare July 19, 2020 22:41

Adds Auth0 as IdP

fed39a1

jaime-talkdesk force-pushed the adds_auth0 branch from 21afcf8 to fed39a1 Compare July 19, 2020 22:57

Rugvip reviewed Jul 24, 2020

View reviewed changes

packages/core/src/layout/Sidebar/UserSettings.tsx Outdated Show resolved Hide resolved

Merge branch 'master' into adds_auth0

6d5157b

soapraj added 2 commits August 17, 2020 10:10

Fix auth0 backend provider

033233d

Merge branch 'master' of github.com:spotify/backstage into adds_auth0

981e66d

nikek approved these changes Aug 17, 2020

View reviewed changes

nikek merged commit c5c2c2c into backstage:master Aug 17, 2020

jaime-talkdesk deleted the adds_auth0 branch August 20, 2020 08:42

adamdmharvey mentioned this pull request Feb 9, 2021

Add auth0 auth #347

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds Auth0 as IdP #1611

Adds Auth0 as IdP #1611

jaime-talkdesk commented Jul 13, 2020 •

edited

Rugvip left a comment

Rugvip Jul 14, 2020

jaime-talkdesk Jul 14, 2020

Rugvip Jul 14, 2020

jaime-talkdesk Jul 19, 2020

jaime-talkdesk Jul 19, 2020

Rugvip Jul 24, 2020

Rugvip Jul 14, 2020

jaime-talkdesk Jul 14, 2020

Rugvip Jul 14, 2020

jaime-talkdesk Jul 14, 2020

Rugvip Jul 14, 2020

jaime-talkdesk Jul 14, 2020

jaime-talkdesk Jul 19, 2020

soapraj Jul 14, 2020

jaime-talkdesk Jul 19, 2020

soapraj Jul 14, 2020 •

edited

jaime-talkdesk Jul 19, 2020

soapraj Jul 14, 2020 •

edited

jaime-talkdesk Jul 19, 2020

soapraj Jul 14, 2020

jaime-talkdesk Jul 19, 2020

Rugvip commented Aug 12, 2020

soapraj commented Aug 12, 2020

jaime-talkdesk commented Aug 20, 2020


		constructor(private readonly sessionManager: SessionManager<Auth0Session>) {}

		async getAccessToken(

Adds Auth0 as IdP #1611

Adds Auth0 as IdP #1611

Conversation

jaime-talkdesk commented Jul 13, 2020 • edited

Hey, I just made a Pull Request!

✔️ Checklist

Rugvip left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soapraj Jul 14, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

soapraj Jul 14, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Rugvip commented Aug 12, 2020

soapraj commented Aug 12, 2020

jaime-talkdesk commented Aug 20, 2020

jaime-talkdesk commented Jul 13, 2020 •

edited

soapraj Jul 14, 2020 •

edited

soapraj Jul 14, 2020 •

edited