Merge pull request #7335 from RoadieHQ/custom-redirect-url-github-provider

Add ability to override github app callback url

.changeset/pretty-feet-explode.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Allow users to override callback url of GitHub provider

docs/auth/github/provider.md

@@ -50,6 +50,10 @@ The GitHub provider is a structure with three configuration keys:
 - `clientSecret`: The client secret tied to the generated client ID.
 - `enterpriseInstanceUrl` (optional): The base URL for a GitHub Enterprise
   instance, e.g. `https://ghe.<company>.com`. Only needed for GitHub Enterprise.
+- `callbackUrl` (optional): The callback url that GitHub will use when
+  initiating an OAuth flow, e.g.
+  `https://your-intermediate-service.com/handler`. Only needed if Backstage is
+  not the immediate receiver (e.g. one OAuth app for many backstage instances).
 
 ## Adding the provider to the Backstage frontend
 

plugins/auth-backend/src/providers/github/provider.ts

@@ -223,6 +223,7 @@ export const createGithubProvider = (
       const enterpriseInstanceUrl = envConfig.getOptionalString(
         'enterpriseInstanceUrl',
       );
+      const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
       const authorizationUrl = enterpriseInstanceUrl
         ? `${enterpriseInstanceUrl}/login/oauth/authorize`
         : undefined;
@@ -232,7 +233,9 @@ export const createGithubProvider = (
       const userProfileUrl = enterpriseInstanceUrl
         ? `${enterpriseInstanceUrl}/api/v3/user`
         : undefined;
-      const callbackUrl = `${globalConfig.baseUrl}/${providerId}/handler/frame`;
+      const callbackUrl =
+        customCallbackUrl ||
+        `${globalConfig.baseUrl}/${providerId}/handler/frame`;
 
       const catalogIdentityClient = new CatalogIdentityClient({
         catalogApi,