paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 41 Packages Projects Releases Wiki Activity

feat(auth-backend): validate catalog user existence on refresh token usage

Browse Source 
Add `experimentalRefreshToken.validateCatalogUserExistence` config option
that checks whether the user's catalog entity still exists before issuing
a new access token during refresh. If the user has been removed from the
catalog (e.g. offboarded), the refresh is rejected and the session is
revoked. Transient catalog errors reject the refresh but preserve the
session for retry.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
This commit is contained in:
MT Lewis
2026-05-06 18:07:00 +01:00
parent e68cb8ac0f
commit 27f24a9a0f
5 changed files with 230 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/validate-catalog-user-on-refresh.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend': patch
---
Added a new `auth.experimentalRefreshToken.validateCatalogUserExistence` config option. When enabled, refresh token usage will verify that the user's catalog entity still exists before issuing a new access token. If the user has been removed from the catalog, the refresh is rejected and the session is revoked. Transient catalog errors reject the refresh but preserve the session for retry.