在Backstage中集成Microsoft Azure进行身份验证并实现伪SSO

import NodeCache from 'node-cache';

// 创建一个 node-cache 实例
const myCache = new NodeCache();

export default myCache;

import { createBackendModule } from '@backstage/backend-plugin-api';
import { microsoftAuthenticator } from '@backstage/plugin-auth-backend-module-microsoft-provider';
import { stringifyEntityRef, DEFAULT_NAMESPACE } from '@backstage/catalog-model';
import {
  authProvidersExtensionPoint,
  createOAuthProviderFactory,
} from '@backstage/plugin-auth-node';
import myCache from '../../../global/node-cache';

const customAzureAuth = createBackendModule({
  // This ID must be exactly "auth" because that's the plugin it targets
  pluginId: 'auth',
  // This ID must be unique, but can be anything
  moduleId: 'custom-auth-provider',
  register(reg) {
    reg.registerInit({
      deps: { providers: authProvidersExtensionPoint },
      async init({ providers }) {
        providers.registerProvider({
          // This ID must match the actual provider config, e.g. addressing
          // auth.providers.github means that this must be "github".
          providerId: 'microsoft',
          // Use createProxyAuthProviderFactory instead if it's one of the proxy
          // based providers rather than an OAuth based one
          factory: createOAuthProviderFactory({
            authenticator: microsoftAuthenticator,
            async signInResolver(info, ctx) {
              if (!info.profile.email) {
                throw new Error(
                  'Login failed, user profile does not contain an email',
                );
              }

              // Split the email into the local part and the domain.
              const [localPart, domain] = info.profile.email.split('@');

              // Next we verify the email domain. It is recommended to include this
              // kind of check if you don't look up the user in an external service.
              if (domain !== 'xxxxxx.com.cn') {
                throw new Error(
                  `Login failed, this email ${info.profile.email} does not belong to the expected domain`,
                );
              }

              // By using `stringifyEntityRef` we ensure that the reference is formatted correctly
              // 使用 idToken 可以实现登录操作
              // info.result.session.idToken
              const userEntity = stringifyEntityRef({
                kind: 'User',
                name: localPart,
                namespace: DEFAULT_NAMESPACE,
              });

              // 将登录用户的 refreshtoken 存入 cache 中，永久保存
              const name = localPart.toLocaleLowerCase();
              myCache.set(
                `${name}_refreshToken`,
                info.result.session.refreshToken,
                0,
              );
              console.log('refreshToken:', info.result.session.refreshToken);

              return ctx.issueToken({
                claims: {
                  sub: userEntity,
                  ent: [userEntity],
                },
              });

              /** *******************************************************************
               * Custom resolver code goes here, see farther down in this article! *
               * "info" is the sign in result from the upstream (github here), and *
               * "ctx" contains useful utilities for token issuance etc.           *
               ******************************************************************* **/
            },
          }),
        });
      },
    });
  },
});

export default customAzureAuth;

// ... other plugins
backend.add(import('./plugins/azureAuth'));