Merge pull request #8035 from zfalen-deloitte/bugfix/duplicate-backstage-token

Bugfix/duplicate backstage token

.changeset/ninety-grapes-love.md

@@ -0,0 +1,6 @@
+---
+'@backstage/core-components': patch
+'@backstage/plugin-auth-backend': patch
+---
+
+Update OAuthAdapter to create identity.token from identity.idToken if it does not exist, and prevent overwrites to identity.toke. Update login page commonProvider to prefer .token over .idToken

packages/core-components/src/layout/SignInPage/commonProvider.tsx

@@ -49,7 +49,9 @@ const Component: ProviderComponent = ({ config, onResult }) => {
         userId: identity!.id,
         profile: profile!,
         getIdToken: () => {
-          return authApi.getBackstageIdentity().then(i => i!.idToken);
+          return authApi
+            .getBackstageIdentity()
+            .then(i => i!.token ?? i!.idToken);
         },
         signOut: async () => {
           await authApi.signOut();

plugins/auth-backend/src/lib/oauth/OAuthAdapter.test.ts

@@ -22,7 +22,7 @@ import { OAuthHandlers } from './types';
 const mockResponseData = {
   providerInfo: {
     accessToken: 'ACCESS_TOKEN',
-    idToken: 'ID_TOKEN',
+    token: 'ID_TOKEN',
     expiresInSeconds: 10,
     scope: 'email',
   },
@@ -216,7 +216,7 @@ describe('OAuthAdapter', () => {
       ...mockResponseData,
       backstageIdentity: {
         id: mockResponseData.backstageIdentity.id,
-        idToken: 'my-id-token',
+        token: 'my-id-token',
       },
     });
   });

plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts

@@ -233,10 +233,12 @@ export class OAuthAdapter implements AuthProviderRouteHandlers {
       return;
     }
 
-    if (!identity.idToken) {
-      identity.idToken = await this.options.tokenIssuer.issueToken({
+    if (!(identity.token || identity.idToken)) {
+      identity.token = await this.options.tokenIssuer.issueToken({
         claims: { sub: identity.id },
       });
+    } else if (!identity.token && identity.idToken) {
+      identity.token = identity.idToken;
     }
   }