diff --git a/plugins/auth-node/package.json b/plugins/auth-node/package.json
index 92ad426a11..b0c503c144 100644
--- a/plugins/auth-node/package.json
+++ b/plugins/auth-node/package.json
@@ -41,7 +41,9 @@
     "lodash": "^4.17.21",
     "node-fetch": "^2.6.7",
     "passport": "^0.6.0",
-    "winston": "^3.2.1"
+    "winston": "^3.2.1",
+    "zod": "^3.21.4",
+    "zod-to-json-schema": "^3.21.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",
diff --git a/plugins/auth-node/src/sign-in/createSignInResolverFactory.ts b/plugins/auth-node/src/sign-in/createSignInResolverFactory.ts
new file mode 100644
index 0000000000..25e65754fe
--- /dev/null
+++ b/plugins/auth-node/src/sign-in/createSignInResolverFactory.ts
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { ZodSchema, ZodTypeDef } from 'zod';
+import { SignInResolver } from '../types';
+import zodToJsonSchema from 'zod-to-json-schema';
+import { JsonObject } from '@backstage/types';
+
+export interface SignInResolverFactory<TAuthResult, TOptions> {
+  (
+    ...options: undefined extends TOptions
+      ? [options?: TOptions]
+      : [options: TOptions]
+  ): SignInResolver<TAuthResult>;
+  optionsJsonSchema?: JsonObject;
+}
+
+export interface SignInResolverFactoryOptions<
+  TAuthResult,
+  TOptionsOutput,
+  TOptionsInput,
+> {
+  optionsSchema?: ZodSchema<TOptionsOutput, ZodTypeDef, TOptionsInput>;
+  create(options: TOptionsOutput): SignInResolver<TAuthResult>;
+}
+
+export function createSignInResolverFactory<
+  TAuthResult,
+  TOptionsOutput,
+  TOptionsInput,
+>(
+  options: SignInResolverFactoryOptions<
+    TAuthResult,
+    TOptionsOutput,
+    TOptionsInput
+  >,
+): SignInResolverFactory<TAuthResult, TOptionsInput> {
+  const { optionsSchema } = options;
+  if (!optionsSchema) {
+    return (resolverOptions?: TOptionsInput) => {
+      if (resolverOptions) {
+        throw new Error('sign-in resolver does not accept options');
+      }
+      return options.create(undefined as TOptionsOutput);
+    };
+  }
+  const factory = (
+    ...[resolverOptions]: undefined extends TOptionsInput
+      ? [options?: TOptionsInput]
+      : [options: TOptionsInput]
+  ) => {
+    const parsedOptions = optionsSchema.parse(resolverOptions);
+    return options.create(parsedOptions);
+  };
+
+  factory.optionsJsonSchema = zodToJsonSchema(optionsSchema) as JsonObject;
+  return factory;
+}
diff --git a/plugins/auth-node/src/sign-in/index.ts b/plugins/auth-node/src/sign-in/index.ts
new file mode 100644
index 0000000000..fd5b95b970
--- /dev/null
+++ b/plugins/auth-node/src/sign-in/index.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright 2023 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { createSignInResolverFactory } from './createSignInResolverFactory';
diff --git a/yarn.lock b/yarn.lock
index 7c10183f74..47a73df84f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4664,6 +4664,8 @@ __metadata:
     passport: ^0.6.0
     uuid: ^8.0.0
     winston: ^3.2.1
+    zod: ^3.21.4
+    zod-to-json-schema: ^3.21.4
   languageName: unknown
   linkType: soft
 
@@ -43089,12 +43091,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod-to-json-schema@npm:^3.20.4":
-  version: 3.20.4
-  resolution: "zod-to-json-schema@npm:3.20.4"
+"zod-to-json-schema@npm:^3.20.4, zod-to-json-schema@npm:^3.21.4":
+  version: 3.21.4
+  resolution: "zod-to-json-schema@npm:3.21.4"
   peerDependencies:
-    zod: ^3.20.0
-  checksum: 55bc649dbc82ce25fbfbfdd42ca530d883d83be5d02cb81e89f6401d54bca151fc6b8cc57999c75eb6a3dcaa3f000697315fbd4f505637472621570ed52784d8
+    zod: ^3.21.4
+  checksum: 899c1f461fb6547c0b08a265c82040c250be9b88d3f408f2f3ff77a418fdfad7549077e589d418fccb312c1f6d555c3c7217b199cc9072762e1fab20716dd2a6
   languageName: node
   linkType: hard