From 018b0910e06fa697b0bad6d9724357ad91f9958d Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 2 Apr 2024 16:29:26 +0200 Subject: [PATCH] backend-app-api,auth: add ent claim to user identity proof Co-authored-by: Camila Belo Signed-off-by: Patrik Oldsberg --- .../src/services/implementations/auth/authServiceFactory.ts | 1 + plugins/auth-backend/src/identity/TokenFactory.ts | 3 ++- plugins/auth-node/src/types.ts | 5 +++++ 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts index 6c3a80e101..39dd88aafa 100644 --- a/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts +++ b/packages/backend-app-api/src/services/implementations/auth/authServiceFactory.ts @@ -252,6 +252,7 @@ class DefaultAuthService implements AuthService { JSON.stringify({ typ: 'vnd.backstage.limited-user', sub: payload.sub, + ent: payload.ent, iat: payload.iat, exp: payload.exp, }), diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts index b0cde6ed3b..b89225eca5 100644 --- a/plugins/auth-backend/src/identity/TokenFactory.ts +++ b/plugins/auth-backend/src/identity/TokenFactory.ts @@ -116,7 +116,7 @@ export class TokenFactory implements TokenIssuer { const uip = await this.createUserIdentityClaim({ header: { alg: key.alg, kid: key.kid }, - payload: { typ: TokenTypes.limitedUser.typClaim, sub, iat, exp }, + payload: { typ: TokenTypes.limitedUser.typClaim, sub, ent, iat, exp }, key: signingKey, }); @@ -264,6 +264,7 @@ export class TokenFactory implements TokenIssuer { const payload = { typ: options.payload.typ, sub: options.payload.sub, + ent: options.payload.ent, iat: options.payload.iat, exp: options.payload.exp, }; diff --git a/plugins/auth-node/src/types.ts b/plugins/auth-node/src/types.ts index 97bee3e3c6..fe84da38a4 100644 --- a/plugins/auth-node/src/types.ts +++ b/plugins/auth-node/src/types.ts @@ -462,6 +462,11 @@ export interface BackstageUserIdentityProofPayload { */ sub: string; + /** + * The ownership entity refs of the user + */ + ent?: string[]; + /** * Standard expiry in epoch seconds */