Forward authorization header token

plugins/scaffolder-backend/package.json

@@ -34,6 +34,7 @@
     "@backstage/catalog-model": "^0.7.0",
     "@backstage/config": "^0.1.2",
     "@backstage/integration": "^0.3.1",
+    "@backstage/plugin-auth-backend": "^0.2.12",
     "@gitbeaker/core": "^28.0.2",
     "@gitbeaker/node": "^28.0.2",
     "@octokit/rest": "^18.0.12",

plugins/scaffolder-backend/src/service/router.ts

@@ -15,6 +15,7 @@
  */
 
 import { Config } from '@backstage/config';
+import { IdentityClient } from '@backstage/plugin-auth-backend';
 import Docker from 'dockerode';
 import express from 'express';
 import { resolve as resolvePath } from 'path';
@@ -45,11 +46,6 @@ export interface RouterOptions {
   entityClient: CatalogEntityClient;
 }
 
-// Avoid import of @backstage/core
-type BackstageIdentity = {
-  idToken: string;
-};
-
 export async function createRouter(
   options: RouterOptions,
 ): Promise<express.Router> {
@@ -103,9 +99,8 @@ export async function createRouter(
       };
 
       // Forward authorization from client
-      const user = req.user as BackstageIdentity;
       const template = await entityClient.findTemplate(templateName, {
-        token: user?.idToken,
+        token: IdentityClient.getBearerToken(req.headers.authorization),
       });
 
       const validationResult: ValidatorResult = validate(