Merge branch 'master' of github.com:spotify/backstage into migrate-to-msw

* 'master' of github.com:spotify/backstage: (139 commits)
  Cleanup
  Update PinButton.test.tsx
  feat: update github insights plugin version (#2973)
  Ignore IntelliJ *.iml files (#2971)
  chore(deps): bump rollup-plugin-dts from 1.4.11 to 1.4.13
  fix the plugin card on plugins page
  align 'Add to Marketplace' button on plugins page
  fix the PluginGrid on mobiles sizes
  use getBy query instead of queryBy when asserting for elements present in document (#2951)
  Update PinButton.tsx
  Add test case for Progress component (#2953)
  fix the styling of footer copy on mobile
  add changeset
  handle the case where no entities are available to show
  core-api: work around issue with ApiRef export const declarations
  core-api: move utility api system implementation into apis/system
  Update docs regarding npm config ignore-scripts flag
  Another try
  Fix Core Features configuration id (#2948)
  Fix test?
  ...

plugins/auth-backend/src/lib/passport/PassportStrategyHelper.test.ts

@@ -16,6 +16,7 @@
 
 import express from 'express';
 import passport from 'passport';
+import { InternalOAuthError } from 'passport-oauth2';
 import {
   executeRedirectStrategy,
   executeFrameHandlerStrategy,
@@ -58,7 +59,11 @@ describe('PassportStrategyHelper', () => {
     }
     class MyCustomAuthErrorStrategy extends passport.Strategy {
       authenticate() {
-        this.error(new Error('MyCustomAuth error'));
+        this.error(
+          new InternalOAuthError('MyCustomAuth error', {
+            data: '{ "message": "Custom message" }',
+          }),
+        );
       }
     }
     class MyCustomAuthRedirectStrategy extends passport.Strategy {
@@ -97,7 +102,7 @@ describe('PassportStrategyHelper', () => {
       );
       expect(spyAuthenticate).toBeCalledTimes(1);
       await expect(frameHandlerStrategyPromise).rejects.toThrow(
-        'Authentication failed, Error: MyCustomAuth error',
+        'Authentication failed, MyCustomAuth error - Custom message',
       );
     });
 

plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts

@@ -18,6 +18,7 @@ import express from 'express';
 import passport from 'passport';
 import jwtDecoder from 'jwt-decode';
 import { ProfileInfo, RedirectInfo } from '../../providers/types';
+import { InternalOAuthError } from 'passport-oauth2';
 
 export type PassportDoneCallback<Res, Private = never> = (
   err?: Error,
@@ -95,8 +96,22 @@ export const executeFrameHandlerStrategy = async <T, PrivateInfo = never>(
       ) => {
         reject(new Error(`Authentication rejected, ${info.message ?? ''}`));
       };
-      strategy.error = (error: Error) => {
-        reject(new Error(`Authentication failed, ${error}`));
+      strategy.error = (error: InternalOAuthError) => {
+        let message = `Authentication failed, ${error.message}`;
+
+        if (error.oauthError?.data) {
+          try {
+            const errorData = JSON.parse(error.oauthError.data);
+
+            if (errorData.message) {
+              message += ` - ${errorData.message}`;
+            }
+          } catch (parseError) {
+            message += ` - ${error.oauthError}`;
+          }
+        }
+
+        reject(new Error(message));
       };
       strategy.redirect = () => {
         reject(new Error('Unexpected redirect'));

plugins/auth-backend/src/providers/saml/provider.ts

@@ -41,8 +41,10 @@ type SamlInfo = {
 export class SamlAuthProvider implements AuthProviderRouteHandlers {
   private readonly strategy: SamlStrategy;
   private readonly tokenIssuer: TokenIssuer;
+  private readonly appUrl: string;
 
   constructor(options: SAMLProviderOptions) {
+    this.appUrl = options.appUrl;
     this.tokenIssuer = options.tokenIssuer;
     this.strategy = new SamlStrategy({ ...options }, ((
       profile: SamlProfile,
@@ -82,7 +84,7 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
         claims: { sub: id },
       });
 
-      return postMessageResponse(res, 'http://localhost:3000', {
+      return postMessageResponse(res, this.appUrl, {
         type: 'authorization_response',
         response: {
           providerInfo: {},
@@ -91,7 +93,7 @@ export class SamlAuthProvider implements AuthProviderRouteHandlers {
         },
       });
     } catch (error) {
-      return postMessageResponse(res, 'http://localhost:3000', {
+      return postMessageResponse(res, this.appUrl, {
         type: 'authorization_response',
         error: {
           name: error.name,
@@ -115,6 +117,7 @@ type SAMLProviderOptions = {
   issuer: string;
   path: string;
   tokenIssuer: TokenIssuer;
+  appUrl: string;
 };
 
 export const createSamlProvider: AuthProviderFactory = ({
@@ -131,6 +134,7 @@ export const createSamlProvider: AuthProviderFactory = ({
     issuer,
     path: `${url.pathname}/${providerId}/handler/frame`,
     tokenIssuer,
+    appUrl: globalConfig.appUrl,
   };
 
   return new SamlAuthProvider(opts);