Merge pull request #23475 from backstage/blam/fix-scaffolder-auth

scaffolder: support unauthenticated requests

.changeset/grumpy-turtles-vanish.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Fix support for unauthenticated requests to create scaffolder tasks

plugins/scaffolder-backend/src/service/router.ts

@@ -461,13 +461,15 @@ export async function createRouter(
         defaultKind: 'template',
       });
 
-      const credentials = await httpAuth.credentials(req, { allow: ['user'] });
-
+      const credentials = await httpAuth.credentials(req);
       const { token } = await auth.getPluginRequestToken({
         onBehalfOf: credentials,
         targetPluginId: 'catalog',
       });
-      const userEntityRef = credentials.principal.userEntityRef;
+
+      const userEntityRef = auth.isPrincipal(credentials, 'user')
+        ? credentials.principal.userEntityRef
+        : undefined;
 
       const userEntity = userEntityRef
         ? await catalogClient.getEntityByRef(userEntityRef, { token })