From 74801b176bae4b34faef9bce97f586a1817239d9 Mon Sep 17 00:00:00 2001 From: Nataliya Issayeva Date: Wed, 10 Nov 2021 16:05:52 -0500 Subject: [PATCH] Update authenticate api request tutorial doc Signed-off-by: Nataliya Issayeva --- .../tutorials/authenticate-api-requests.md | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/contrib/docs/tutorials/authenticate-api-requests.md b/contrib/docs/tutorials/authenticate-api-requests.md index 9f651ddd1a..d25e4a832a 100644 --- a/contrib/docs/tutorials/authenticate-api-requests.md +++ b/contrib/docs/tutorials/authenticate-api-requests.md @@ -6,6 +6,13 @@ API requests from frontend plugins include an authorization header with a Backst **NOTE**: Enabling this means that Backstage will stop working for guests, as no token is issued for them. +Since the middleware always expects a valid token, API requests from backend plugins will need one as well. Backends have no concept of a Backstage identity so instead they use a token generated using a shared key from the `app-config.yaml`. +You can generate a unique key for your app in a terminal, and set the `BACKEND_SECRET` environment variable to the resulting value. + +```bash +node -p 'require("crypto").randomBytes(24).toString("base64")' +``` + As techdocs HTML pages load assets without an Authorization header the code below also sets a token cookie when the user logs in (and when the token is about to expire). ```typescript @@ -60,7 +67,13 @@ async function main() { const token = IdentityClient.getBearerToken(req.headers.authorization) || req.cookies['token']; - req.user = await identity.authenticate(token); + + // Authenticate all requests originating from backends by default + const isServerToken = await authEnv.tokenManager.isServerToken(token); + if (!isServerToken) { + req.user = await identity.authenticate(token); + } + if (!req.headers.authorization) { // Authorization header may be forwarded by plugin requests req.headers.authorization = `Bearer ${token}`; @@ -261,3 +274,9 @@ export const plugin = createPlugin({ ], }); ``` + +In the (probably unlikely) case that you need to authenticate from a backend plugin, the plugin environment contains a `tokenManager` that will provide a server token to use in the request: + +``` +const { token } = await this.tokenManager.getServerToken(); +```