diff --git a/.changeset/seven-adults-act.md b/.changeset/seven-adults-act.md index 93541e06a6..fa2839aad2 100644 --- a/.changeset/seven-adults-act.md +++ b/.changeset/seven-adults-act.md @@ -2,14 +2,24 @@ '@backstage/plugin-auth-backend': patch --- -Adds custom sign-in resolvers and profile transformation for Google auth provider. Read more about what this means for Backstage user identity and determining ownership of entities https://backstage.io/docs/auth/identity-resolver -Related the [RFC] From Identity to Ownership, v2 https://github.com/backstage/backstage/issues/4089 +Adds support for custom sign-in resolvers and profile transformations for the +Google auth provider. -Adds `ent` field in the claims of Backstage ID Token with a list of entity references containing identity and membership info about the user across multiple systems. +Adds an `ent` claim in Backstage tokens, with a list of +[entity references](https://backstage.io/docs/features/software-catalog/references) +related to your signed-in user's identities and groups across multiple systems. -Adds an optional `providerFactories` to the `createRouter` exported by the auth-backend plugin. +Adds an optional `providerFactories` argument to the `createRouter` exported by +the `auth-backend` plugin. Updates `BackstageIdentity` so that - `idToken` is deprecated in favor of `token` - An optional `entity` field is added which represents the entity that the user is represented by within Backstage. + +More information: + +- [The identity resolver documentation](https://backstage.io/docs/auth/identity-resolver) + explains the concepts and shows how to implement your own. +- The [From Identity to Ownership](https://github.com/backstage/backstage/issues/4089) + RFC contains details about how this affects ownership in the catalog diff --git a/packages/backend/src/plugins/auth.ts b/packages/backend/src/plugins/auth.ts index 3157284df7..2b1c85f052 100644 --- a/packages/backend/src/plugins/auth.ts +++ b/packages/backend/src/plugins/auth.ts @@ -14,10 +14,7 @@ * limitations under the License. */ -import { - createGoogleProvider, - createRouter, -} from '@backstage/plugin-auth-backend'; +import { createRouter } from '@backstage/plugin-auth-backend'; import { Router } from 'express'; import { PluginEnvironment } from '../types'; @@ -27,27 +24,5 @@ export default async function createPlugin({ config, discovery, }: PluginEnvironment): Promise { - return await createRouter({ - logger, - config, - database, - discovery, - providerFactories: { - google: createGoogleProvider({ - signIn: { - // resolver: 'email', - resolver: async ({ profile: { email } }, ctx) => { - if (!email) { - throw new Error('No email associated with user account'); - } - const id = email.split('@')[0]; - const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: id, ent: [`User:default/${id}`] }, - }); - return { id, token }; - }, - }, - }), - }, - }); + return await createRouter({ logger, config, database, discovery }); } diff --git a/test.yaml b/test.yaml new file mode 100644 index 0000000000..e69de29bb2