From d298d9221430380bdc903fc0750f7ee1d5221713 Mon Sep 17 00:00:00 2001 From: dominikiwanekhyland <141320833+dominikiwanekhyland@users.noreply.github.com> Date: Fri, 14 Nov 2025 08:31:31 +0100 Subject: [PATCH] [ACS-10592] Remove 'secret' field from OAUTH config across ADF/ACA/ADW (#11332) --- docs/core/components/login.component.md | 3 --- docs/user-guide/authentication.md | 4 +--- lib/cli/scripts/init-aae-env.ts | 8 -------- .../src/lib/app-config/app.config.schema.json | 3 --- .../src/lib/auth/models/oauth-config.model.ts | 1 - .../src/lib/auth/oidc/auth-config.service.spec.ts | 10 ++-------- lib/core/src/lib/auth/oidc/auth-config.service.ts | 2 +- lib/js-api/docs/authentication.md | 5 +---- lib/js-api/src/authentication/oauth2Auth.ts | 9 ++------- lib/js-api/src/authentication/oauth2Config.ts | 1 - lib/js-api/test/alfrescoApi.spec.ts | 1 - lib/js-api/test/oauth2Auth.spec.ts | 15 --------------- lib/js-api/test/oauth2AuthImplicitFlow.spec.ts | 5 ----- 13 files changed, 7 insertions(+), 60 deletions(-) diff --git a/docs/core/components/login.component.md b/docs/core/components/login.component.md index dcab85c41f..5d4962767b 100644 --- a/docs/core/components/login.component.md +++ b/docs/core/components/login.component.md @@ -196,7 +196,6 @@ You can access an external provider to get an auth token for a user: "oauth2" : { "host": "http://myhost.com", "clientId": "my-client-id", - "secret": "" } } ``` @@ -294,7 +293,6 @@ enabled the setting in `app.config.json`) then the [login component](login.compo "host": "/auth/realms/alfresco", "clientId": "activiti", "scope": "openid", - "secret": "", "implicitFlow": true, "silentLogin": false, "redirectUri": "/", @@ -324,7 +322,6 @@ You can also enable automatic redirection to the OAuth provider using the follow "host": "/auth/realms/alfresco", "clientId": "alfresco", "scope": "openid", - "secret": "", "implicitFlow": true, "silentLogin": true, "redirectSilentIframeUri": "/assets/silent-refresh.html", diff --git a/docs/user-guide/authentication.md b/docs/user-guide/authentication.md index a2037dcc04..53c69c408e 100644 --- a/docs/user-guide/authentication.md +++ b/docs/user-guide/authentication.md @@ -33,7 +33,7 @@ OAuth2 is a protocol that allows the application to authorize operations without silentLogin: Enables silent authentication. - secret: The application's secret, used for secure authentication. + secret: Deprecated and removed. The application's secret, used for secure authentication. redirectUri: Where to redirect after a successful login. @@ -86,7 +86,6 @@ OAuth2 is a protocol that allows the application to authorize operations without "oauth2": { "host": "https://your-idp.auth0.com", "clientId": "", - "secret": "", "scope": "openid profile email offline_access", "implicitFlow": false, "codeFlow": true, @@ -112,7 +111,6 @@ OAuth2 is a protocol that allows the application to authorize operations without "oauth2": { "host": "https://cognito-idp.your-idp-url", "clientId": "", - "secret": "", "scope": "openid profile email", "implicitFlow": false, "codeFlow": true, diff --git a/lib/cli/scripts/init-aae-env.ts b/lib/cli/scripts/init-aae-env.ts index 4882be8130..d520b2bbe1 100755 --- a/lib/cli/scripts/init-aae-env.ts +++ b/lib/cli/scripts/init-aae-env.ts @@ -38,7 +38,6 @@ export interface ConfigArgs { oauth: string; tokenEndpoint: string; clientId: string; - secret: string; scope: string; host: string; tag: string; @@ -450,7 +449,6 @@ function getAlfrescoJsApiInstance(configArgs: ConfigArgs): AlfrescoApi { tokenUrl: `${ssoHost}/${configArgs.tokenEndpoint}`, clientId: `${configArgs.clientId}`, scope: `${configArgs.scope}`, - secret: `${configArgs.secret}`, implicitFlow: false, silentLogin: false, redirectUri: '/' @@ -776,10 +774,6 @@ Options: clientId: { type: 'string' }, - secret: { - type: 'string', - default: '' - }, scope: { type: 'string', default: 'openid' @@ -815,7 +809,6 @@ Options: host: values.host as string, oauth: values.oauth as string, clientId: values.clientId as string, - secret: values.secret as string, scope: values.scope as string, tokenEndpoint: values.tokenEndpoint as string, modelerUsername: values.modelerUsername as string, @@ -836,7 +829,6 @@ Options: oauth: options.oauth, tokenEndpoint: options.tokenEndpoint, scope: options.scope, - secret: options.secret, tag: options.tag, envs: options.envs }; diff --git a/lib/core/src/lib/app-config/app.config.schema.json b/lib/core/src/lib/app-config/app.config.schema.json index 7491920565..197e0645ed 100644 --- a/lib/core/src/lib/app-config/app.config.schema.json +++ b/lib/core/src/lib/app-config/app.config.schema.json @@ -1535,9 +1535,6 @@ "type": "string", "description": "The client's id as registered with the auth server" }, - "secret": { - "type": "string" - }, "redirectUri": { "type": "string", "description": "The client's redirectUri as registered with the auth server" diff --git a/lib/core/src/lib/auth/models/oauth-config.model.ts b/lib/core/src/lib/auth/models/oauth-config.model.ts index 63d3d403ad..278024c423 100644 --- a/lib/core/src/lib/auth/models/oauth-config.model.ts +++ b/lib/core/src/lib/auth/models/oauth-config.model.ts @@ -23,7 +23,6 @@ export interface OauthConfigModel { codeFlow?: boolean; redirectUri: string; silentLogin?: boolean; - secret?: string; redirectUriLogout?: string; logoutUrl?: string; audience?: string; diff --git a/lib/core/src/lib/auth/oidc/auth-config.service.spec.ts b/lib/core/src/lib/auth/oidc/auth-config.service.spec.ts index f7e71983e9..56a44e3654 100644 --- a/lib/core/src/lib/auth/oidc/auth-config.service.spec.ts +++ b/lib/core/src/lib/auth/oidc/auth-config.service.spec.ts @@ -31,7 +31,6 @@ describe('AuthConfigService', () => { host: 'http://localhost:3000/auth/realms/alfresco', clientId: 'fakeClientId', scope: 'openid profile email', - secret: '', implicitFlow: true, silentLogin: true, redirectSilentIframeUri: 'http://localhost:3000/assets/silent-refresh.html', @@ -44,7 +43,6 @@ describe('AuthConfigService', () => { host: 'http://localhost:3000/auth/realms/alfresco', clientId: 'fakeClientId', scope: 'openid profile email', - secret: '', implicitFlow: true, silentLogin: true, redirectSilentIframeUri: 'http://localhost:3000/subfolder/assets/silent-refresh.html', @@ -57,7 +55,6 @@ describe('AuthConfigService', () => { host: 'http://localhost:3000/auth/realms/alfresco', clientId: 'fakeClientId', scope: 'openid profile email', - secret: '', implicitFlow: true, silentLogin: true, redirectSilentIframeUri: 'http://localhost:3000/subfolder2/assets/silent-refresh.html', @@ -70,7 +67,6 @@ describe('AuthConfigService', () => { host: 'http://localhost:3000/auth/realms/alfresco', clientId: 'fakeClientId', scope: 'openid profile email', - secret: '', implicitFlow: true, silentLogin: true, redirectSilentIframeUri: 'http://localhost:3000/assets/silent-refresh.html', @@ -83,7 +79,6 @@ describe('AuthConfigService', () => { host: 'http://localhost:3000/auth/realms/alfresco', clientId: 'fakeClientId', scope: 'openid profile email', - secret: '', implicitFlow: false, codeFlow: true, silentLogin: true, @@ -116,7 +111,7 @@ describe('AuthConfigService', () => { postLogoutRedirectUri: 'http://localhost:3000/#/logout', clientId: 'fakeClientId', scope: 'openid profile email', - dummyClientSecret: '' + dummyClientSecret: 'dummyClientSecret' }; expect(await service.loadConfig()).toEqual(jasmine.objectContaining(expectedConfig)); @@ -133,7 +128,7 @@ describe('AuthConfigService', () => { clientId: 'fakeClientId', scope: 'openid profile email', responseType: 'code', - dummyClientSecret: '' + dummyClientSecret: 'dummyClientSecret' }; expect(await service.loadConfig()).toEqual(jasmine.objectContaining(expectedConfig)); @@ -180,7 +175,6 @@ describe('AuthConfigService', () => { host: 'http://localhost:3000/auth/realms/alfresco', clientId: 'fakeClientId', scope: 'openid profile email', - secret: '', implicitFlow: true, silentLogin: true, redirectSilentIframeUri: 'http://localhost:3000/assets/silent-refresh.html', diff --git a/lib/core/src/lib/auth/oidc/auth-config.service.ts b/lib/core/src/lib/auth/oidc/auth-config.service.ts index 0e0128ca0e..40cf4c1eb9 100644 --- a/lib/core/src/lib/auth/oidc/auth-config.service.ts +++ b/lib/core/src/lib/auth/oidc/auth-config.service.ts @@ -69,7 +69,7 @@ export class AuthConfigService { postLogoutRedirectUri: this.generatePostLogoutUri(origin, oauth2.redirectUriLogout), clientId: oauth2.clientId, scope: oauth2.scope, - dummyClientSecret: oauth2.secret || '', + dummyClientSecret: 'dummyClientSecret', logoutUrl: oauth2.logoutUrl, customQueryParams, ...(oauth2.codeFlow && { responseType: 'code' }), diff --git a/lib/js-api/docs/authentication.md b/lib/js-api/docs/authentication.md index c87f33acb2..ac20fb3490 100644 --- a/lib/js-api/docs/authentication.md +++ b/lib/js-api/docs/authentication.md @@ -128,7 +128,7 @@ If your want to redirect to the authorization server and login there, you can us |-------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------| | host | Your oauth2 server URL | null | | clientId | Your clientId oauth2 | null | -| secret | Your secret oauth2 | null | +| secret | **Deprecated** - Not used in implicit flow and should not be included in browser applications | null | | scope | Your scope | null | | implicitFlow | true/false | false | | redirectUri | url to be redirect after login | null | @@ -160,7 +160,6 @@ const alfrescoApi = new AlfrescoApi({ oauth2: { host: 'HOST_OAUTH2_SERVER', clientId: 'YOUR_CLIENT_ID', - secret: 'SECRET', scope: 'openid', implicitFlow: true, redirectUri: 'YOUR_HOME_APP_URL', @@ -180,7 +179,6 @@ const alfrescoApi = new AlfrescoApi({ oauth2: { host: 'HOST_OAUTH2_SERVER', clientId: 'YOUR_CLIENT_ID', - secret: 'SECRET', scope: 'openid', implicitFlow: true, redirectUri: 'YOUR_HOME_APP_URL', @@ -202,7 +200,6 @@ const alfrescoApi = new AlfrescoApi({ oauth2: { host: 'HOST_OAUTH2_SERVER', clientId: 'YOUR_CLIENT_ID', - secret: 'SECRET' }, authType: 'OAUTH', provider: 'ALL' diff --git a/lib/js-api/src/authentication/oauth2Auth.ts b/lib/js-api/src/authentication/oauth2Auth.ts index 08a22366ea..e9ad8c8b1f 100644 --- a/lib/js-api/src/authentication/oauth2Auth.ts +++ b/lib/js-api/src/authentication/oauth2Auth.ts @@ -99,10 +99,6 @@ export class Oauth2Auth extends AlfrescoApiClient { throw new Error('Missing the required oauth2 scope parameter'); } - if (this.config.oauth2.secret === undefined || this.config.oauth2.secret === null) { - this.config.oauth2.secret = ''; - } - if ((this.config.oauth2.redirectUri === undefined || this.config.oauth2.redirectUri === null) && this.config.oauth2.implicitFlow) { throw new Error('Missing redirectUri required parameter'); } @@ -580,8 +576,7 @@ export class Oauth2Auth extends AlfrescoApiClient { username, password, grant_type: 'password', - client_id: this.config.oauth2.clientId, - client_secret: this.config.oauth2.secret + client_id: this.config.oauth2.clientId }; const contentTypes = ['application/x-www-form-urlencoded']; @@ -624,7 +619,7 @@ export class Oauth2Auth extends AlfrescoApiClient { * @returns promise of void */ refreshToken(): Promise { - const auth = 'Basic ' + this.universalBtoa(this.config.oauth2.clientId + ':' + this.config.oauth2.secret); + const auth = 'Basic ' + this.universalBtoa(this.config.oauth2.clientId); const headerParams = { 'Content-Type': 'application/x-www-form-urlencoded', 'Cache-Control': 'no-cache', diff --git a/lib/js-api/src/authentication/oauth2Config.ts b/lib/js-api/src/authentication/oauth2Config.ts index 7863460f4a..7e2fe860ab 100644 --- a/lib/js-api/src/authentication/oauth2Config.ts +++ b/lib/js-api/src/authentication/oauth2Config.ts @@ -17,7 +17,6 @@ export interface Oauth2Config { clientId: string; - secret?: string; host: string; authorizationUrl?: string; tokenUrl?: string; diff --git a/lib/js-api/test/alfrescoApi.spec.ts b/lib/js-api/test/alfrescoApi.spec.ts index 6101b253c9..6f91c4f91b 100644 --- a/lib/js-api/test/alfrescoApi.spec.ts +++ b/lib/js-api/test/alfrescoApi.spec.ts @@ -326,7 +326,6 @@ describe('Basic configuration test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, diff --git a/lib/js-api/test/oauth2Auth.spec.ts b/lib/js-api/test/oauth2Auth.spec.ts index 316bc73337..894420dc96 100644 --- a/lib/js-api/test/oauth2Auth.spec.ts +++ b/lib/js-api/test/oauth2Auth.spec.ts @@ -128,7 +128,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -143,7 +142,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -175,7 +173,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -201,7 +198,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout', implicitFlow: false, @@ -271,7 +267,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -297,7 +292,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -331,7 +325,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -358,7 +351,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -385,7 +377,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -420,7 +411,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -460,7 +450,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -500,7 +489,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -525,7 +513,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -549,7 +536,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, @@ -586,7 +572,6 @@ describe('Oauth2 test', () => { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', scope: 'openid', - secret: '', redirectUri: '/', redirectUriLogout: '/logout' }, diff --git a/lib/js-api/test/oauth2AuthImplicitFlow.spec.ts b/lib/js-api/test/oauth2AuthImplicitFlow.spec.ts index 76537f053e..e15e5d23d2 100644 --- a/lib/js-api/test/oauth2AuthImplicitFlow.spec.ts +++ b/lib/js-api/test/oauth2AuthImplicitFlow.spec.ts @@ -55,7 +55,6 @@ describe('Oauth2 Implicit flow test', () => { oauth2: { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', - secret: '', scope: 'openid', implicitFlow: true, redirectUri: undefined @@ -77,7 +76,6 @@ describe('Oauth2 Implicit flow test', () => { oauth2: { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', - secret: '', scope: 'openid', implicitFlow: true, redirectUri: 'redirectUri' @@ -101,7 +99,6 @@ describe('Oauth2 Implicit flow test', () => { oauth2: { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', - secret: '', scope: 'openid', implicitFlow: true, redirectUri: '#/redirectUri' @@ -129,7 +126,6 @@ describe('Oauth2 Implicit flow test', () => { oauth2: { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', - secret: '', scope: 'openid', implicitFlow: true, redirectUri: 'redirectUri' @@ -161,7 +157,6 @@ describe('Oauth2 Implicit flow test', () => { oauth2: { host: 'https://myOauthUrl:30081/auth/realms/springboot', clientId: 'activiti', - secret: '', scope: 'openid', implicitFlow: true, redirectUri: 'redirectUri'