Merge pull request #11132 from backstage/rugvip/auth-fix

auth-backend: fix ent claim being dropped

.changeset/beige-panthers-dream.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixed a bug that was introduced in `0.13.1-next.0` which caused the `ent` claim of issued tokens to be dropped.

plugins/auth-backend/src/identity/TokenFactory.test.ts

@@ -47,7 +47,9 @@ describe('TokenFactory', () => {
     });
 
     await expect(factory.listPublicKeys()).resolves.toEqual({ keys: [] });
-    const token = await factory.issueToken({ claims: { sub: entityRef } });
+    const token = await factory.issueToken({
+      claims: { sub: entityRef, ent: [entityRef] },
+    });
 
     const { keys } = await factory.listPublicKeys();
     const keyStore = createLocalJWKSet({ keys: keys });
@@ -57,6 +59,7 @@ describe('TokenFactory', () => {
       iss: 'my-issuer',
       aud: 'backstage',
       sub: entityRef,
+      ent: [entityRef],
       iat: expect.any(Number),
       exp: expect.any(Number),
     });

plugins/auth-backend/src/identity/TokenFactory.ts

@@ -89,7 +89,7 @@ export class TokenFactory implements TokenIssuer {
       throw new AuthenticationError('No algorithm was provided in the key');
     }
 
-    return new SignJWT({ iss, sub, aud, iat, exp })
+    return new SignJWT({ iss, sub, ent, aud, iat, exp })
       .setProtectedHeader({ alg: key.alg, kid: key.kid })
       .setIssuer(iss)
       .setAudience(aud)