Merge pull request #9033 from backstage/sub-is-full-ref

Sub is full ref

.changeset/three-bats-provide.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': minor
+---
+
+Update provider subs to return full entity ref.

plugins/auth-backend/src/providers/github/provider.test.ts

@@ -93,7 +93,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'jimmymarkum',
-          token: 'token-for-jimmymarkum',
+          token: 'token-for-user:default/jimmymarkum',
         },
         providerInfo: {
           accessToken: '19xasczxcm9n7gacn9jdgm19me',
@@ -138,7 +138,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'jimmymarkum',
-          token: 'token-for-jimmymarkum',
+          token: 'token-for-user:default/jimmymarkum',
         },
         providerInfo: {
           accessToken: '19xasczxcm9n7gacn9jdgm19me',
@@ -181,7 +181,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'jimmymarkum',
-          token: 'token-for-jimmymarkum',
+          token: 'token-for-user:default/jimmymarkum',
         },
         providerInfo: {
           accessToken: '19xasczxcm9n7gacn9jdgm19me',
@@ -224,7 +224,7 @@ describe('GithubAuthProvider', () => {
       const expected = {
         backstageIdentity: {
           id: 'daveboyle',
-          token: 'token-for-daveboyle',
+          token: 'token-for-user:default/daveboyle',
         },
         providerInfo: {
           accessToken:
@@ -268,7 +268,7 @@ describe('GithubAuthProvider', () => {
         response: {
           backstageIdentity: {
             id: 'ipd12039',
-            token: 'token-for-ipd12039',
+            token: 'token-for-user:default/ipd12039',
           },
           providerInfo: {
             accessToken: 'a.b.c',
@@ -322,7 +322,7 @@ describe('GithubAuthProvider', () => {
         response: {
           backstageIdentity: {
             id: 'mockuser',
-            token: 'token-for-mockuser',
+            token: 'token-for-user:default/mockuser',
           },
           profile: {
             displayName: 'Mocked User',

plugins/auth-backend/src/providers/github/provider.ts

@@ -191,7 +191,10 @@ export const githubDefaultSignInResolver: SignInResolver<GithubOAuthResult> =
     const userId = fullProfile.username || fullProfile.id;
 
     const token = await ctx.tokenIssuer.issueToken({
-      claims: { sub: userId, ent: [`user:default/${userId}`] },
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
     });
 
     return { id: userId, token };

plugins/auth-backend/src/providers/gitlab/provider.ts

@@ -72,7 +72,7 @@ export const gitlabDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   }
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: id, ent: [`user:default/${id}`] },
+    claims: { sub: `user:default/${id}`, ent: [`user:default/${id}`] },
   });
 
   return { id, token };

plugins/auth-backend/src/providers/microsoft/provider.ts

@@ -231,7 +231,10 @@ export const microsoftDefaultSignInResolver: SignInResolver<OAuthResult> =
     const userId = profile.email.split('@')[0];
 
     const token = await ctx.tokenIssuer.issueToken({
-      claims: { sub: userId, ent: [`user:default/${userId}`] },
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
     });
 
     return { id: userId, token };

plugins/auth-backend/src/providers/oauth2/provider.ts

@@ -211,7 +211,7 @@ export const oAuth2DefaultSignInResolver: SignInResolver<OAuthResult> = async (
   const userId = profile.email.split('@')[0];
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };

plugins/auth-backend/src/providers/okta/provider.ts

@@ -236,7 +236,7 @@ export const oktaDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   const userId = profile.email.split('@')[0];
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };