fixed

Signed-off-by: Chris Gemmell <chris.gemmell8@gmail.com>

.changeset/spotty-donkeys-give.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-auth-backend-module-microsoft-provider': minor
+'@backstage/plugin-auth-backend': patch
+---
+
+Moved existing emailMatchingUserEntityAnnotation into `@backstage/plugin-auth-backend-module-microsoft-provider` and adapted SignInResolvers correctly"

plugins/auth-backend-module-microsoft-provider/src/resolvers.ts

@@ -15,8 +15,8 @@
  */
 
 import {
-  createSignInResolverFactory,
   OAuthAuthenticatorResult,
+  createSignInResolverFactory,
   PassportProfile,
   SignInInfo,
 } from '@backstage/plugin-auth-node';
@@ -30,7 +30,7 @@ export namespace microsoftSignInResolvers {
   /**
    * Looks up the user by matching their Microsoft username to the entity name.
    */
-  export const commonByEmailLocalPartResolver = createSignInResolverFactory({
+  export const emailMatchingUserEntityAnnotation = createSignInResolverFactory({
     create() {
       return async (
         info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,
@@ -39,36 +39,12 @@ export namespace microsoftSignInResolvers {
         const { profile } = info;
 
         if (!profile.email) {
-          throw new Error(
-            'Login failed, user profile does not contain an email',
-          );
-        }
-        const [localPart] = profile.email.split('@');
-
-        return ctx.signInWithCatalogUser({
-          entityRef: { name: localPart },
-        });
-      };
-    },
-  });
-
-  export const commonByEmailResolver = createSignInResolverFactory({
-    create() {
-      return async (
-        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,
-        ctx,
-      ) => {
-        const { profile } = info;
-
-        if (!profile.email) {
-          throw new Error(
-            'Login failed, user profile does not contain an email',
-          );
+          throw new Error('Microsoft profile contained no email');
         }
 
         return ctx.signInWithCatalogUser({
-          filter: {
-            'spec.profile.email': profile.email,
+          annotations: {
+            'microsoft.com/email': profile.email,
           },
         });
       };

plugins/auth-backend/src/providers/microsoft/provider.ts

@@ -17,12 +17,19 @@
 import { SignInResolver, AuthHandler } from '../types';
 import { OAuthResult } from '../../lib/oauth';
 import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
-import { createOAuthProviderFactory } from '@backstage/plugin-auth-node';
+import {
+  commonSignInResolvers,
+  createOAuthProviderFactory,
+} from '@backstage/plugin-auth-node';
 import {
   adaptLegacyOAuthHandler,
   adaptLegacyOAuthSignInResolver,
+  adaptOAuthSignInResolverToLegacy,
 } from '../../lib/legacy';
-import { microsoftAuthenticator } from '@backstage/plugin-auth-backend-module-microsoft-provider';
+import {
+  microsoftAuthenticator,
+  microsoftSignInResolvers,
+} from '@backstage/plugin-auth-backend-module-microsoft-provider';
 
 /**
  * Auth provider integration for GitLab auth
@@ -50,4 +57,12 @@ export const microsoft = createAuthProviderIntegration({
       signInResolver: adaptLegacyOAuthSignInResolver(options?.signIn?.resolver),
     });
   },
+  resolvers: adaptOAuthSignInResolverToLegacy({
+    emailLocalPartMatchingUserEntityName:
+      commonSignInResolvers.emailLocalPartMatchingUserEntityName(),
+    emailMatchingUserEntityProfileEmail:
+      commonSignInResolvers.emailMatchingUserEntityProfileEmail(),
+    emailMatchingUserEntityAnnotation:
+      microsoftSignInResolvers.emailMatchingUserEntityAnnotation(),
+  }),
 });