diff --git a/app-config.yaml b/app-config.yaml index b3ca3c7203..1156b9b340 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -378,6 +378,8 @@ auth: clientId: ${AUTH_ATLASSIAN_CLIENT_ID} clientSecret: ${AUTH_ATLASSIAN_CLIENT_SECRET} scopes: ${AUTH_ATLASSIAN_SCOPES} + myproxy: + development: {} costInsights: engineerCost: 200000 products: diff --git a/packages/backend/src/plugins/auth.ts b/packages/backend/src/plugins/auth.ts index 8a60b4b4bd..3b51e130ea 100644 --- a/packages/backend/src/plugins/auth.ts +++ b/packages/backend/src/plugins/auth.ts @@ -14,6 +14,10 @@ * limitations under the License. */ +import { + DEFAULT_NAMESPACE, + stringifyEntityRef, +} from '@backstage/catalog-model'; import { createRouter, providers, @@ -89,6 +93,39 @@ export default async function createPlugin( }, }, }), + + // This is an example of how to configure the OAuth2Proxy provider as well + // as how to sign a user in without a matching user entity in the catalog. + // You can try it out using `` + myproxy: providers.oauth2Proxy.create({ + async authHandler(result) { + const user = result.getHeader('x-forwarded-user'); + if (!user) { + throw new Error('Profile must have a username'); + } + return { + profile: { + email: result.getHeader('x-forwarded-email'), + displayName: user, + }, + }; + }, + signIn: { + async resolver({ result }, ctx) { + const entityRef = stringifyEntityRef({ + kind: 'user', + namespace: DEFAULT_NAMESPACE, + name: result.getHeader('x-forwarded-user')!, + }); + return ctx.issueToken({ + claims: { + sub: entityRef, + ent: [entityRef], + }, + }); + }, + }, + }), }, }); }