search

backstage / backstage

Backstage is an open framework for building developer portals
https://backstage.io/
Apache License 2.0
27.52k stars 5.83k forks source link

🐛 Bug Report: microsoft authenticator not working #25725

Open crazy-canux opened 1 month ago

crazy-canux commented 1 month ago

📜 Description

After upgrade from 1.25 to 1.29, microsoft authenticator not working.

👍 Expected behavior

SSO login works.

👎 Actual Behavior with Screenshots

SSO login not working, always ask said "Approval required".

👟 Reproduction steps

follow official guide. debug localy.

📃 Provide the context for the Bug.

auth:
  environment: development
  providers:
    microsoft:
      development:
        clientId: ******
        tenantId: ******
        clientSecret: ******
        additionalScopes:
          - Mail.Send
        signIn:
          resolvers:
            - resolver: emailMatchingUserEntityProfileEmail

🖥️ Your Environment

OS:   Darwin 23.5.0 - darwin/arm64
node: v18.20.3
yarn: 3.8.1
cli:  0.26.11 (local)
backstage:  N/A

Dependencies:
  @backstage/app-defaults                                            0.0.0-use.local
  @backstage/backend-app-api                                         0.0.0-use.local
  @backstage/backend-common                                          0.0.0-use.local
  @backstage/backend-defaults                                        0.0.0-use.local
  @backstage/backend-dev-utils                                       0.0.0-use.local
  @backstage/backend-dynamic-feature-service                         0.0.0-use.local
  @backstage/backend-openapi-utils                                   0.0.0-use.local
  @backstage/backend-plugin-api                                      0.0.0-use.local
  @backstage/backend-tasks                                           0.0.0-use.local
  @backstage/backend-test-utils                                      0.0.0-use.local
  @backstage/catalog-client                                          0.0.0-use.local
  @backstage/catalog-model                                           0.0.0-use.local
  @backstage/cli-common                                              0.0.0-use.local
  @backstage/cli-node                                                0.0.0-use.local
  @backstage/cli                                                     0.0.0-use.local
  @backstage/codemods                                                0.0.0-use.local
  @backstage/config-loader                                           0.0.0-use.local
  @backstage/config                                                  0.0.0-use.local
  @backstage/core-app-api                                            0.0.0-use.local
  @backstage/core-compat-api                                         0.0.0-use.local
  @backstage/core-components                                         0.0.0-use.local, 0.13.10
  @backstage/core-plugin-api                                         0.0.0-use.local
  @backstage/create-app                                              0.0.0-use.local
  @backstage/dev-utils                                               0.0.0-use.local
  @backstage/e2e-test-utils                                          0.0.0-use.local
  @backstage/errors                                                  0.0.0-use.local
  @backstage/eslint-plugin                                           0.0.0-use.local
  @backstage/frontend-app-api                                        0.0.0-use.local
  @backstage/frontend-plugin-api                                     0.0.0-use.local
  @backstage/frontend-test-utils                                     0.0.0-use.local
  @backstage/integration-aws-node                                    0.0.0-use.local
  @backstage/integration-react                                       0.0.0-use.local
  @backstage/integration                                             0.0.0-use.local
  @backstage/plugin-api-docs-module-protoc-gen-doc                   0.0.0-use.local
  @backstage/plugin-api-docs                                         0.0.0-use.local
  @backstage/plugin-app-backend                                      0.0.0-use.local
  @backstage/plugin-app-node                                         0.0.0-use.local
  @backstage/plugin-app-visualizer                                   0.0.0-use.local
  @backstage/plugin-auth-backend-module-atlassian-provider           0.0.0-use.local
  @backstage/plugin-auth-backend-module-aws-alb-provider             0.0.0-use.local
  @backstage/plugin-auth-backend-module-azure-easyauth-provider      0.0.0-use.local
  @backstage/plugin-auth-backend-module-bitbucket-provider           0.0.0-use.local
  @backstage/plugin-auth-backend-module-cloudflare-access-provider   0.0.0-use.local
  @backstage/plugin-auth-backend-module-gcp-iap-provider             0.0.0-use.local
  @backstage/plugin-auth-backend-module-github-provider              0.0.0-use.local
  @backstage/plugin-auth-backend-module-gitlab-provider              0.0.0-use.local
  @backstage/plugin-auth-backend-module-google-provider              0.0.0-use.local
  @backstage/plugin-auth-backend-module-guest-provider               0.0.0-use.local
  @backstage/plugin-auth-backend-module-microsoft-provider           0.0.0-use.local
  @backstage/plugin-auth-backend-module-oauth2-provider              0.0.0-use.local
  @backstage/plugin-auth-backend-module-oauth2-proxy-provider        0.0.0-use.local
  @backstage/plugin-auth-backend-module-oidc-provider                0.0.0-use.local
  @backstage/plugin-auth-backend-module-okta-provider                0.0.0-use.local
  @backstage/plugin-auth-backend-module-onelogin-provider            0.0.0-use.local
  @backstage/plugin-auth-backend-module-pinniped-provider            0.0.0-use.local
  @backstage/plugin-auth-backend-module-vmware-cloud-provider        0.0.0-use.local
  @backstage/plugin-auth-backend                                     0.0.0-use.local
  @backstage/plugin-auth-node                                        0.0.0-use.local
  @backstage/plugin-auth-react                                       0.0.0-use.local
  @backstage/plugin-bitbucket-cloud-common                           0.0.0-use.local
  @backstage/plugin-catalog-backend-module-aws                       0.0.0-use.local
  @backstage/plugin-catalog-backend-module-azure                     0.0.0-use.local
  @backstage/plugin-catalog-backend-module-backstage-openapi         0.0.0-use.local
  @backstage/plugin-catalog-backend-module-bitbucket-cloud           0.0.0-use.local
  @backstage/plugin-catalog-backend-module-bitbucket-server          0.0.0-use.local
  @backstage/plugin-catalog-backend-module-gcp                       0.0.0-use.local
  @backstage/plugin-catalog-backend-module-gerrit                    0.0.0-use.local
  @backstage/plugin-catalog-backend-module-github-org                0.0.0-use.local
  @backstage/plugin-catalog-backend-module-github                    0.0.0-use.local
  @backstage/plugin-catalog-backend-module-gitlab-org                0.0.0-use.local
  @backstage/plugin-catalog-backend-module-gitlab                    0.0.0-use.local
  @backstage/plugin-catalog-backend-module-incremental-ingestion     0.0.0-use.local
  @backstage/plugin-catalog-backend-module-ldap                      0.0.0-use.local
  @backstage/plugin-catalog-backend-module-logs                      0.0.0-use.local
  @backstage/plugin-catalog-backend-module-msgraph                   0.0.0-use.local
  @backstage/plugin-catalog-backend-module-openapi                   0.0.0-use.local
  @backstage/plugin-catalog-backend-module-puppetdb                  0.0.0-use.local
  @backstage/plugin-catalog-backend-module-scaffolder-entity-model   0.0.0-use.local
  @backstage/plugin-catalog-backend-module-unprocessed               0.0.0-use.local
  @backstage/plugin-catalog-backend                                  0.0.0-use.local
  @backstage/plugin-catalog-common                                   0.0.0-use.local
  @backstage/plugin-catalog-graph                                    0.0.0-use.local
  @backstage/plugin-catalog-import                                   0.0.0-use.local
  @backstage/plugin-catalog-node                                     0.0.0-use.local
  @backstage/plugin-catalog-react                                    0.0.0-use.local
  @backstage/plugin-catalog-unprocessed-entities-common              0.0.0-use.local
  @backstage/plugin-catalog-unprocessed-entities                     0.0.0-use.local
  @backstage/plugin-catalog                                          0.0.0-use.local
  @backstage/plugin-config-schema                                    0.0.0-use.local
  @backstage/plugin-devtools-backend                                 0.0.0-use.local
  @backstage/plugin-devtools-common                                  0.0.0-use.local
  @backstage/plugin-devtools                                         0.0.0-use.local
  @backstage/plugin-events-backend-module-aws-sqs                    0.0.0-use.local
  @backstage/plugin-events-backend-module-azure                      0.0.0-use.local
  @backstage/plugin-events-backend-module-bitbucket-cloud            0.0.0-use.local
  @backstage/plugin-events-backend-module-gerrit                     0.0.0-use.local
  @backstage/plugin-events-backend-module-github                     0.0.0-use.local
  @backstage/plugin-events-backend-module-gitlab                     0.0.0-use.local
  @backstage/plugin-events-backend-test-utils                        0.0.0-use.local
  @backstage/plugin-events-backend                                   0.0.0-use.local
  @backstage/plugin-events-node                                      0.0.0-use.local
  @backstage/plugin-home-react                                       0.0.0-use.local
  @backstage/plugin-home                                             0.0.0-use.local
  @backstage/plugin-kubernetes-backend                               0.0.0-use.local
  @backstage/plugin-kubernetes-cluster                               0.0.0-use.local
  @backstage/plugin-kubernetes-common                                0.0.0-use.local
  @backstage/plugin-kubernetes-node                                  0.0.0-use.local
  @backstage/plugin-kubernetes-react                                 0.0.0-use.local
  @backstage/plugin-kubernetes                                       0.0.0-use.local
  @backstage/plugin-notifications-backend-module-email               0.0.0-use.local
  @backstage/plugin-notifications-backend                            0.0.0-use.local
  @backstage/plugin-notifications-common                             0.0.0-use.local
  @backstage/plugin-notifications-node                               0.0.0-use.local
  @backstage/plugin-notifications                                    0.0.0-use.local
  @backstage/plugin-org-react                                        0.0.0-use.local
  @backstage/plugin-org                                              0.0.0-use.local
  @backstage/plugin-permission-backend-module-allow-all-policy       0.0.0-use.local
  @backstage/plugin-permission-backend                               0.0.0-use.local
  @backstage/plugin-permission-common                                0.0.0-use.local
  @backstage/plugin-permission-node                                  0.0.0-use.local
  @backstage/plugin-permission-react                                 0.0.0-use.local
  @backstage/plugin-proxy-backend                                    0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-azure                  0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-bitbucket-cloud        0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-bitbucket-server       0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-bitbucket              0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-confluence-to-markdown 0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-cookiecutter           0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-gcp                    0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-gerrit                 0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-gitea                  0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-github                 0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-gitlab                 0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-notifications          0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-rails                  0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-sentry                 0.0.0-use.local
  @backstage/plugin-scaffolder-backend-module-yeoman                 0.0.0-use.local
  @backstage/plugin-scaffolder-backend                               0.0.0-use.local
  @backstage/plugin-scaffolder-common                                0.0.0-use.local
  @backstage/plugin-scaffolder-node-test-utils                       0.0.0-use.local
  @backstage/plugin-scaffolder-node                                  0.0.0-use.local
  @backstage/plugin-scaffolder-react                                 0.0.0-use.local
  @backstage/plugin-scaffolder                                       0.0.0-use.local
  @backstage/plugin-search-backend-module-catalog                    0.0.0-use.local
  @backstage/plugin-search-backend-module-elasticsearch              0.0.0-use.local
  @backstage/plugin-search-backend-module-explore                    0.0.0-use.local
  @backstage/plugin-search-backend-module-pg                         0.0.0-use.local
  @backstage/plugin-search-backend-module-stack-overflow-collator    0.0.0-use.local
  @backstage/plugin-search-backend-module-techdocs                   0.0.0-use.local
  @backstage/plugin-search-backend-node                              0.0.0-use.local
  @backstage/plugin-search-backend                                   0.0.0-use.local
  @backstage/plugin-search-common                                    0.0.0-use.local
  @backstage/plugin-search-react                                     0.0.0-use.local
  @backstage/plugin-search                                           0.0.0-use.local
  @backstage/plugin-signals-backend                                  0.0.0-use.local
  @backstage/plugin-signals-node                                     0.0.0-use.local
  @backstage/plugin-signals-react                                    0.0.0-use.local
  @backstage/plugin-signals                                          0.0.0-use.local
  @backstage/plugin-techdocs-addons-test-utils                       0.0.0-use.local
  @backstage/plugin-techdocs-backend                                 0.0.0-use.local
  @backstage/plugin-techdocs-module-addons-contrib                   0.0.0-use.local
  @backstage/plugin-techdocs-node                                    0.0.0-use.local
  @backstage/plugin-techdocs-react                                   0.0.0-use.local
  @backstage/plugin-techdocs                                         0.0.0-use.local
  @backstage/plugin-user-settings-backend                            0.0.0-use.local
  @backstage/plugin-user-settings-common                             0.0.0-use.local
  @backstage/plugin-user-settings                                    0.0.0-use.local
  @backstage/release-manifests                                       0.0.0-use.local
  @backstage/repo-tools                                              0.0.0-use.local
  @backstage/test-utils                                              0.0.0-use.local
  @backstage/theme                                                   0.0.0-use.local
  @backstage/types                                                   0.0.0-use.local
  @backstage/version-bridge                                          0.0.0-use.local

👀 Have you spent some time to check if this bug has been raised before?

🏢 Have you read the Code of Conduct?

Are you willing to submit PR?

None

Rugvip commented 1 month ago

Hmm, could be that the required scopes have changed and they need to be approved over on the Microsoft end? I believe there might be an option to allow users to approve individual scopes as well if you are alright with that.

crazy-canux commented 1 month ago

@Rugvip , I don't think so, because it's working with 1.25. Nothing changes on Azure.

Follow this guide https://backstage.io/docs/auth/identity-resolver#sign-in-without-users-in-the-catalog, I created packages/backend/src/auth.ts, still not working. I believe something changes in 1.29

Rugvip commented 1 month ago

@crazy-canux alright. Could you provide a bit more information about when the error happens and if there are any clues in logs etc.?

crazy-canux commented 1 month ago

No error in logs. The different is "Approval required" popup in 1.29. Is there any changes about the "api permission" on azure?

image

Rugvip commented 1 month ago

Are you able to easily try the old 1.25 version? I'm curious if that screen still appears on the old version or not. It does look like something that's been changed in the Microsoft configuration on your end rather than anything to do with the auth provider in Backstage, although I could be wrong about that ofc.

Rugvip commented 1 month ago

I realize a change that's happened between 1.25 and 1.29 is that the additionalScopes config has been fixed. Earlier it used to never be included, but it is now fixed an will always be included. It's likely that the addition of the Mail.Send scope is what breaks things here, and it should most likely be safe for you to remove it. If you do want it to be included you'll need to configure it in the list of defaultScopes in the frontend MicrosoftAuth implementation instead, due to how the Microsoft auth provider still manages multiple different auth clients for different resources through the frontend.

afscrome commented 1 month ago

That error suggests you need to provide admin consent to one or more permissions. Can you check you've followed the section on Admin Consent at https://backstage.io/docs/auth/microsoft/provider/#configure-app-registration-on-azure .

If you're asking for additional scopes, you'll probably need to grant admin consent for those too.

afscrome commented 1 month ago

Another question is do you really need the Mail.Send scope? If not, I'd just remove that. Mail.Send is included in the docs as an example at https://backstage.io/docs/auth/microsoft/provider/#configuration , but you probably don't want that unless you've built a custom plugin to send email.

Rugvip commented 1 month ago

Somewhat fixed by https://github.com/backstage/backstage/pull/25728. The Mail.Send scope was included in the configuration block in the docs, which I got rid of. In general I don't think we need to advertise the additionalScopes config quite that much.

crazy-canux commented 1 month ago

@Rugvip , @afscrome thanks for help. After remove "Mail.Send", it's working. Like you mentioned, there is a bug, that's why the same configuration works with 1.25, but not working with 1.29.

One more thing. After remove "Mail.Send", I got error with "user don't have email" after setup "sign-in-without-users-in-catalog". https://backstage.io/docs/auth/identity-resolver#sign-in-without-users-in-the-catalog. Now, I use msgraph to import org data before login.

enryson commented 1 month ago

to me is a god idea include this description on the documentation.