From 554aba344be2e9a6d6f1b3d9238b8d9eb5256abc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Tue, 3 May 2022 11:01:52 +0200
Subject: [PATCH] correct and expose the IAP docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 docs/auth/google/gcp-iap-auth.md | 17 ++++++++---------
 docs/auth/index.md               |  1 +
 microsite/sidebars.json          |  1 +
 mkdocs.yml                       |  1 +
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/docs/auth/google/gcp-iap-auth.md b/docs/auth/google/gcp-iap-auth.md
index cdafeb1317..5ac75e6691 100644
--- a/docs/auth/google/gcp-iap-auth.md
+++ b/docs/auth/google/gcp-iap-auth.md
@@ -1,5 +1,5 @@
 ---
-id: provider
+id: gcp-iap-auth
 title: Google Identity-Aware Proxy Provider
 sidebar_label: Google IAP
 # prettier-ignore
@@ -43,7 +43,8 @@ Add a `providerFactories` entry to the router in
 `packages/backend/plugin/auth.ts`.
 
 ```ts
-import { createGcpIapProvider } from '@backstage/plugin-auth-backend';
+import { providers } from '@backstage/plugin-auth-backend';
+import { stringifyEntityRef } from '@backstage/catalog-model';
 
 export default async function createPlugin(
   env: PluginEnvironment,
@@ -54,7 +55,7 @@ export default async function createPlugin(
     database: env.database,
     discovery: env.discovery,
     providerFactories: {
-      'gcp-iap': createGcpIapProvider({
+      'gcp-iap': providers.gcpIap.create({
         // Replace the auth handler if you want to customize the returned user
         // profile info (can be left out; the default implementation is shown
         // below which only returns the email). You may want to amend this code
@@ -71,12 +72,10 @@ export default async function createPlugin(
             // Somehow compute the Backstage token claims. Just some dummy code
             // shown here, but you may want to query your LDAP server, or
             // GSuite or similar, based on the IAP token sub/email claims
-            const id = `user:default/${iapToken.email.split('@')[0]}`;
-            const fullEnt = ['group:default/team-name'];
-            const token = await ctx.tokenIssuer.issueToken({
-              claims: { sub: id, ent: fullEnt },
-            });
-            return { id, token };
+            const id = iapToken.email.split('@')[0];
+            const sub = stringifyEntityRef({ kind: 'User', name: id });
+            const ent = [sub, stringifyEntityRef({ kind: 'Group', name: 'team-name' });
+            return ctx.issueToken({ claims: { sub, ent } });
           },
         },
       }),
diff --git a/docs/auth/index.md b/docs/auth/index.md
index 3beae72d0b..c83005a974 100644
--- a/docs/auth/index.md
+++ b/docs/auth/index.md
@@ -21,6 +21,7 @@ Backstage comes with many common authentication providers in the core library:
 - [GitHub](github/provider.md)
 - [GitLab](gitlab/provider.md)
 - [Google](google/provider.md)
+- [Google IAP](google/gcp-iap-auth.md)
 - [Okta](okta/provider.md)
 - [OneLogin](onelogin/provider.md)
 - [OAuth2Proxy](oauth2-proxy/provider.md)
diff --git a/microsite/sidebars.json b/microsite/sidebars.json
index daa1c9bde6..f96747f0ca 100644
--- a/microsite/sidebars.json
+++ b/microsite/sidebars.json
@@ -244,6 +244,7 @@
           "auth/github/provider",
           "auth/gitlab/provider",
           "auth/google/provider",
+          "auth/google/gcp-iap-auth",
           "auth/okta/provider",
           "auth/onelogin/provider",
           "auth/oauth2-proxy/provider"
diff --git a/mkdocs.yml b/mkdocs.yml
index 6e4e795f95..caaee37f29 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -148,6 +148,7 @@ nav:
           - GitHub: 'auth/github/provider.md'
           - GitLab: 'auth/gitlab/provider.md'
           - Google: 'auth/google/provider.md'
+          - Google IAP: 'auth/google/gcp-iap-auth.md'
           - Okta: 'auth/okta/provider.md'
           - OneLogin: 'auth/onelogin/provider.md'
           - OAuth2Proxy: 'auth/oauth2-proxy/provider.md'