diff --git a/docs/api/deployment/deployment-types.md b/docs/api/deployment/deployment-types.md index e9296c2..987e37e 100644 --- a/docs/api/deployment/deployment-types.md +++ b/docs/api/deployment/deployment-types.md @@ -24,7 +24,7 @@ Installation method for RHDH. ## AuthProvider ```typescript -type AuthProvider = "guest" | "keycloak"; +type AuthProvider = "guest" | "keycloak" | "github"; ``` Authentication provider configuration. diff --git a/docs/changelog.md b/docs/changelog.md index 09325a2..a7e34e8 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -2,7 +2,13 @@ All notable changes to this project will be documented in this file. -## [2.1.9] - Current +## [2.1.10] - Current + +### Fixed + +- **Auth provider dynamic plugins**: Guest, GitHub, and Keycloak (OIDC) auth profiles now enable the matching dynamic plugins. Auth providers are no longer installed statically. + +## [2.1.9] ### Changed diff --git a/docs/guide/deployment/authentication.md b/docs/guide/deployment/authentication.md index 4c6d4f0..3628a11 100644 --- a/docs/guide/deployment/authentication.md +++ b/docs/guide/deployment/authentication.md @@ -48,6 +48,8 @@ SKIP_KEYCLOAK_DEPLOYMENT=true yarn playwright test Keycloak provides OIDC authentication for realistic auth testing. +This profile signs in with stock OIDC (`auth.providers.oidc`, `signInPage: oidc`) against a Keycloak IdP, and loads `oidc-provider` plus the Keycloak catalog module as dynamic plugins. You do not need to add those packages to the workspace `dynamic-plugins.yaml`. + ### Configuration ```typescript @@ -120,7 +122,7 @@ test.beforeAll(async ({ rhdh }) => { ## GitHub Authentication -Allows authentication using github OAuth application. +Allows authentication using github OAuth application. ### Configuration @@ -190,13 +192,15 @@ Package configs: │ └── rhdh-secrets.yaml └── auth/ ├── guest/ # Applied when auth: "guest" - │ └── app-config.yaml + │ ├── app-config.yaml + │ └── dynamic-plugins.yaml └── keycloak/ # Applied when auth: "keycloak" │ ├── app-config.yaml │ ├── dynamic-plugins.yaml │ └── secrets.yaml └── github/ # Applied when auth: "github" ├── app-config.yaml + ├── dynamic-plugins.yaml └── secrets.yaml ``` diff --git a/docs/guide/deployment/index.md b/docs/guide/deployment/index.md index e9c0c9e..d54b833 100644 --- a/docs/guide/deployment/index.md +++ b/docs/guide/deployment/index.md @@ -156,6 +156,7 @@ Configurations are merged in layers: ``` Package defaults → auth/guest/ → Your configs → auth/keycloak/ → + → auth/github/ → ``` Later configurations override earlier ones, allowing you to customize only what you need. diff --git a/package.json b/package.json index 2c158d6..847bfee 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@red-hat-developer-hub/e2e-test-utils", - "version": "2.1.9", + "version": "2.1.10", "description": "Test utilities for RHDH E2E tests", "license": "Apache-2.0", "repository": { diff --git a/src/deployment/rhdh/config/auth/github/dynamic-plugins.yaml b/src/deployment/rhdh/config/auth/github/dynamic-plugins.yaml new file mode 100644 index 0000000..dad56f0 --- /dev/null +++ b/src/deployment/rhdh/config/auth/github/dynamic-plugins.yaml @@ -0,0 +1,12 @@ +plugins: + # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-github-provider:{{inherit}} once published on quay + - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-github-provider:bs_1.52.0__0.5.4 + disabled: false + pluginConfig: + auth: + providers: + github: + production: + clientId: ${GITHUB_OAUTH_APP_ID} + clientSecret: ${GITHUB_OAUTH_APP_SECRET} + callbackUrl: ${RHDH_BASE_URL}/api/auth/github/handler/frame diff --git a/src/deployment/rhdh/config/auth/guest/dynamic-plugins.yaml b/src/deployment/rhdh/config/auth/guest/dynamic-plugins.yaml new file mode 100644 index 0000000..2779d9c --- /dev/null +++ b/src/deployment/rhdh/config/auth/guest/dynamic-plugins.yaml @@ -0,0 +1,9 @@ +plugins: + # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-guest-provider:{{inherit}} once published on quay + - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-guest-provider:bs_1.52.0__0.2.20 + disabled: false + pluginConfig: + auth: + providers: + guest: + dangerouslyAllowOutsideDevelopment: true diff --git a/src/deployment/rhdh/config/auth/keycloak/dynamic-plugins.yaml b/src/deployment/rhdh/config/auth/keycloak/dynamic-plugins.yaml index 92bb9ac..be18f06 100644 --- a/src/deployment/rhdh/config/auth/keycloak/dynamic-plugins.yaml +++ b/src/deployment/rhdh/config/auth/keycloak/dynamic-plugins.yaml @@ -1,5 +1,8 @@ +# catalog-backend-module-keycloak and oidc-provider are disabled in default.packages.yaml, +# so {{inherit}} fails at install. Use explicit overlays tags until these images are on quay.io/rhdh. plugins: - - package: oci://quay.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak:{{inherit}} + # TODO: switch to oci://quay.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak:{{inherit}} once published on quay + - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-catalog-backend-module-keycloak:bs_1.49.4__3.19.2 disabled: false pluginConfig: catalog: @@ -18,3 +21,28 @@ plugins: seconds: 15 timeout: minutes: 1 + # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-oidc-provider:{{inherit}} once published on quay + - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-oidc-provider:bs_1.52.0__0.4.17 + disabled: false + pluginConfig: + auth: + providers: + oidc: + production: + metadataUrl: ${KEYCLOAK_METADATA_URL} + clientId: ${KEYCLOAK_CLIENT_ID} + clientSecret: ${KEYCLOAK_CLIENT_SECRET} + prompt: auto + callbackUrl: ${RHDH_BASE_URL}/api/auth/oidc/handler/frame + signIn: + resolvers: + - resolver: emailLocalPartMatchingUserEntityName + # Workspaces using auth: "keycloak" may still call loginAsGuest() (e.g. topology RBAC). + # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-guest-provider:{{inherit}} once published on quay + - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-guest-provider:bs_1.52.0__0.2.20 + disabled: false + pluginConfig: + auth: + providers: + guest: + dangerouslyAllowOutsideDevelopment: true diff --git a/src/deployment/rhdh/constants.ts b/src/deployment/rhdh/constants.ts index 8d1f316..f662a41 100644 --- a/src/deployment/rhdh/constants.ts +++ b/src/deployment/rhdh/constants.ts @@ -62,7 +62,10 @@ export const AUTH_CONFIG_PATHS: Record< "dist/deployment/rhdh/config/auth/guest/app-config.yaml", ), secrets: "", - dynamicPlugins: "", + dynamicPlugins: path.join( + PACKAGE_ROOT, + "dist/deployment/rhdh/config/auth/guest/dynamic-plugins.yaml", + ), }, keycloak: { appConfig: path.join( @@ -87,7 +90,10 @@ export const AUTH_CONFIG_PATHS: Record< PACKAGE_ROOT, "dist/deployment/rhdh/config/auth/github/secrets.yaml", ), - dynamicPlugins: "", + dynamicPlugins: path.join( + PACKAGE_ROOT, + "dist/deployment/rhdh/config/auth/github/dynamic-plugins.yaml", + ), mergeStrategy: { arrayMergeStrategy: { byKey: "target" } }, }, };