paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 44 Packages Projects Releases Wiki Activity

Added dedicated resolvers section

Browse Source 
Signed-off-by: Andre Wanlin <awanlin@spotify.com>
This commit is contained in:
Andre Wanlin
2024-04-16 11:03:28 -05:00
parent a874dd1524
commit 8383e2ca7d
9 changed files with 105 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/auth/okta/provider.md
+13 -3
View File
@@ -29,7 +29,7 @@ To add Okta authentication, you must create an Application from Okta:
The configuration examples provided above are suitable for local development. For a production deployment, substitute `http://localhost:7007` with the url that your Backstage instance is available at.
# Configuration
## Configuration
The provider configuration can then be added to your `app-config.yaml` under the
root `auth` configuration:
@@ -54,8 +54,6 @@ auth:
- resolver: emailMatchingUserEntityAnnotation
```
> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
The values referenced are found on the Application page on your Okta site.
- `clientId`: The client ID that you generated on Okta, e.g.
@@ -68,6 +66,18 @@ The values referenced are found on the Application page on your Okta site.
`additionalScopes` is an optional value, a string of space separated scopes, that will be combined with the default `scope` value of `openid profile email offline_access` to adjust the `scope` sent to Okta during OAuth. This will have an impact on [the dependent claims returned](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned). For example, setting the `additionalScopes` value to `groups` will result in the claim returning a list of the groups that the user is a member of that also match the ID token group filter of the client app.
### Resolvers
This provider includes several resolvers out of the box that you can use:
- `emailMatchingUserEntityProfileEmail`: Matches the email address from the auth provider with the User entity that has a matching `spec.profile.email`. If no match is found it will throw a `NotFoundError`.
- `emailLocalPartMatchingUserEntityName`: Matches the [local part](https://en.wikipedia.org/wiki/Email_address#Local-part) of the email address from the auth provider with the User entity that has a matching `name`. If no match is found it will throw a `NotFoundError`.
- `emailMatchingUserEntityAnnotation`: Matches the email address from the auth provider with the User entity where the value of the `okta.com/email` annotation matches. If no match is found it will throw a `NotFoundError`.
> Note: The resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
If these resolvers do not fit your needs you can build a custom resolver, this is covered in the [Building Custom Resolvers](../identity-resolver.md#building-custom-resolvers) section of the Sign-in Identities and Resolvers documentation.
## Adding the provider to the Backstage frontend
To add the provider to the frontend, add the `oktaAuthApi` reference and