Add openshiftAuthApiRef and OpenShiftAuth to core API

Signed-off-by: Yannik Daellenbach <yannik@daellenbach.org>

packages/core-app-api/report.api.md

@@ -52,6 +52,7 @@ import { Observable } from '@backstage/types';
 import { oktaAuthApiRef } from '@backstage/core-plugin-api';
 import { oneloginAuthApiRef } from '@backstage/core-plugin-api';
 import { OpenIdConnectApi } from '@backstage/core-plugin-api';
+import { openshiftAuthApiRef } from '@backstage/core-plugin-api';
 import { PendingOAuthRequest } from '@backstage/core-plugin-api';
 import { ProfileInfo } from '@backstage/core-plugin-api';
 import { ProfileInfoApi } from '@backstage/core-plugin-api';
@@ -651,6 +652,12 @@ export type OpenLoginPopupOptions = {
   height?: number;
 };
 
+// @public
+export class OpenShiftAuth {
+  // (undocumented)
+  static create(options: OAuthApiCreateOptions): typeof openshiftAuthApiRef.T;
+}
+
 // @public
 export type PopupOptions = {
   size?:

packages/core-app-api/src/apis/implementations/auth/index.ts

@@ -26,4 +26,5 @@ export * from './bitbucket';
 export * from './bitbucketServer';
 export * from './atlassian';
 export * from './vmwareCloud';
+export * from './openshift';
 export type { OAuthApiCreateOptions, AuthApiCreateOptions } from './types';

packages/core-app-api/src/apis/implementations/auth/openshift/OpenShiftAuth.ts

@@ -0,0 +1,52 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { openshiftAuthApiRef } from '@backstage/core-plugin-api';
+import { OAuth2 } from '../oauth2';
+import { OAuthApiCreateOptions } from '../types';
+
+const DEFAULT_PROVIDER = {
+  id: 'openshift',
+  title: 'OpenShift',
+  icon: () => null,
+};
+
+/**
+ * Implements the OAuth flow to OpenShift
+ *
+ * @public
+ */
+export default class OpenShiftAuth {
+  static create(options: OAuthApiCreateOptions): typeof openshiftAuthApiRef.T {
+    const {
+      configApi,
+      discoveryApi,
+      environment = 'development',
+      provider = DEFAULT_PROVIDER,
+      oauthRequestApi,
+      defaultScopes = ['user:info'],
+    } = options;
+
+    return OAuth2.create({
+      configApi,
+      discoveryApi,
+      oauthRequestApi,
+      provider,
+      environment,
+      defaultScopes,
+    });
+  }
+}

packages/core-app-api/src/apis/implementations/auth/openshift/index.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { default as OpenShiftAuth } from './OpenShiftAuth';

packages/core-plugin-api/report.api.md

@@ -604,6 +604,11 @@ export type OpenIdConnectApi = {
   getIdToken(options?: AuthRequestOptions): Promise<string>;
 };
 
+// @public
+export const openshiftAuthApiRef: ApiRef<
+  OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionApi
+>;
+
 // @public @deprecated
 export type OptionalParams<
   Params extends {

packages/core-plugin-api/src/apis/definitions/auth.ts

@@ -474,3 +474,20 @@ export const vmwareCloudAuthApiRef: ApiRef<
 > = createApiRef({
   id: 'core.auth.vmware-cloud',
 });
+
+/**
+ * Provides authentication towards OpenShift APIs and identities.
+ *
+ * @public
+ * @remarks
+ *
+ * See {@link https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/authentication_and_authorization/configuring-oauth-clients}
+ * on how to configure the OAuth clients and
+ * {@link https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html-single/authentication_and_authorization/index#tokens-scoping-about_configuring-internal-oauth}
+ * for available scopes.
+ */
+export const openshiftAuthApiRef: ApiRef<
+  OAuthApi & ProfileInfoApi & BackstageIdentityApi & SessionApi
+> = createApiRef({
+  id: 'core.auth.openshift',
+});