backend: add oauth2Proxy setup example

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

app-config.yaml

@@ -378,6 +378,8 @@ auth:
         clientId: ${AUTH_ATLASSIAN_CLIENT_ID}
         clientSecret: ${AUTH_ATLASSIAN_CLIENT_SECRET}
         scopes: ${AUTH_ATLASSIAN_SCOPES}
+    myproxy:
+      development: {}
 costInsights:
   engineerCost: 200000
   products:

packages/backend/src/plugins/auth.ts

@@ -14,6 +14,10 @@
  * limitations under the License.
  */
 
+import {
+  DEFAULT_NAMESPACE,
+  stringifyEntityRef,
+} from '@backstage/catalog-model';
 import {
   createRouter,
   providers,
@@ -89,6 +93,39 @@ export default async function createPlugin(
           },
         },
       }),
+
+      // This is an example of how to configure the OAuth2Proxy provider as well
+      // as how to sign a user in without a matching user entity in the catalog.
+      // You can try it out using `<ProxiedSignInPage {...props} provider="myproxy" />`
+      myproxy: providers.oauth2Proxy.create({
+        async authHandler(result) {
+          const user = result.getHeader('x-forwarded-user');
+          if (!user) {
+            throw new Error('Profile must have a username');
+          }
+          return {
+            profile: {
+              email: result.getHeader('x-forwarded-email'),
+              displayName: user,
+            },
+          };
+        },
+        signIn: {
+          async resolver({ result }, ctx) {
+            const entityRef = stringifyEntityRef({
+              kind: 'user',
+              namespace: DEFAULT_NAMESPACE,
+              name: result.getHeader('x-forwarded-user')!,
+            });
+            return ctx.issueToken({
+              claims: {
+                sub: entityRef,
+                ent: [entityRef],
+              },
+            });
+          },
+        },
+      }),
     },
   });
 }