backend-app-api,auth: add ent claim to user identity proof

Co-authored-by: Camila Belo <camilaibs@gmail.com>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts

@@ -252,6 +252,7 @@ class DefaultAuthService implements AuthService {
         JSON.stringify({
           typ: 'vnd.backstage.limited-user',
           sub: payload.sub,
+          ent: payload.ent,
           iat: payload.iat,
           exp: payload.exp,
         }),

plugins/auth-backend/src/identity/TokenFactory.ts

@@ -116,7 +116,7 @@ export class TokenFactory implements TokenIssuer {
 
     const uip = await this.createUserIdentityClaim({
       header: { alg: key.alg, kid: key.kid },
-      payload: { typ: TokenTypes.limitedUser.typClaim, sub, iat, exp },
+      payload: { typ: TokenTypes.limitedUser.typClaim, sub, ent, iat, exp },
       key: signingKey,
     });
 
@@ -264,6 +264,7 @@ export class TokenFactory implements TokenIssuer {
     const payload = {
       typ: options.payload.typ,
       sub: options.payload.sub,
+      ent: options.payload.ent,
       iat: options.payload.iat,
       exp: options.payload.exp,
     };

plugins/auth-node/src/types.ts

@@ -462,6 +462,11 @@ export interface BackstageUserIdentityProofPayload {
    */
   sub: string;
 
+  /**
+   * The ownership entity refs of the user
+   */
+  ent?: string[];
+
   /**
    * Standard expiry in epoch seconds
    */