Added SingIn Resolvers Config Details

Signed-off-by: Andre Wanlin <awanlin@spotify.com>

docs/auth/atlassian/provider.md

@@ -47,8 +47,15 @@ auth:
         clientId: ${AUTH_ATLASSIAN_CLIENT_ID}
         clientSecret: ${AUTH_ATLASSIAN_CLIENT_SECRET}
         scope: ${AUTH_ATLASSIAN_SCOPES}
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: usernameMatchingUserEntityName
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The Atlassian provider is a structure with three configuration keys:
 
 - `clientId`: The Key you generated in the developer console.

docs/auth/github/provider.md

@@ -41,8 +41,15 @@ auth:
         clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
         ## uncomment if using GitHub Enterprise
         # enterpriseInstanceUrl: ${AUTH_GITHUB_ENTERPRISE_INSTANCE_URL}
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: usernameMatchingUserEntityName
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The GitHub provider is a structure with three configuration keys:
 
 - `clientId`: The client ID that you generated on GitHub, e.g.

docs/auth/gitlab/provider.md

@@ -43,8 +43,15 @@ auth:
         # audience: https://gitlab.company.com
         ## uncomment if using a custom redirect URI
         # callbackUrl: https://${BASE_URL}/api/auth/gitlab/handler/frame
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: usernameMatchingUserEntityName
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The GitLab provider is a structure with three configuration keys:
 
 - `clientId`: The Application ID that you generated on GitLab, e.g.

docs/auth/google/gcp-iap-auth.md

@@ -27,8 +27,15 @@ auth:
     gcp-iap:
       audience: '/projects/<project number>/global/backendServices/<backend service id>'
       jwtHeader: x-custom-header # Optional: Only if you are using a custom header for the IAP JWT
+      signIn:
+        resolvers:
+          - resolver: emailMatchingUserEntityProfileEmail
+          - resolver: emailLocalPartMatchingUserEntityName
+          - resolver: emailMatchingUserEntityAnnotation
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The full `audience` value can be obtained by visiting your [Identity-Aware Proxy Google Cloud console](https://console.cloud.google.com/security/iap), selecting your project, finding your Backend Service to proxy, clicking the 3 vertical dots then "Get JWT Audience Code", and copying from the resulting popup, which will look similar to the following:
 
 ![Identity-Aware Proxy JWT Audience Code popup](../../assets/auth/gcp-iap-jwt-audience-code-popup.png)
@@ -94,6 +101,27 @@ Now the backend is ready to serve auth requests on the
 `/api/auth/gcp-iap/refresh` endpoint. All that's left is to update the frontend
 sign-in mechanism to poll that endpoint through the IAP, on the user's behalf.
 
+### New Backend System
+
+There is a module for this provider that works with the new backend system.
+
+First you'll want to run this command to add the module:
+
+```sh
+ yarn --cwd packages/backend add @backstage/plugin-auth-backend-module-gcp-iap-provider
+```
+
+Then you will need to add this to your backend:
+
+```ts title="packages/backend/src/index.ts"
+const backend = createBackend();
+
+backend.add(import('@backstage/plugin-auth-backend'));
+/* highlight-add-start */
+backend.add(import('@backstage/plugin-auth-backend-module-gcp-iap-provider'));
+/* highlight-add-end */
+```
+
 ## Frontend Changes
 
 It is recommended to use the `ProxiedSignInPage` for this provider, which is

docs/auth/google/provider.md

@@ -42,8 +42,15 @@ auth:
       development:
         clientId: ${AUTH_GOOGLE_CLIENT_ID}
         clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET}
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: emailMatchingUserEntityAnnotation
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The Google provider is a structure with two configuration keys:
 
 - `clientId`: The client ID that you generated, e.g.

docs/auth/microsoft/provider.md

@@ -57,8 +57,15 @@ auth:
         domainHint: ${AZURE_TENANT_ID}
         additionalScopes:
           - Mail.Send
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: emailMatchingUserEntityAnnotation
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The Microsoft provider is a structure with three mandatory configuration keys:
 
 - `clientId`: Application (client) ID, found on App Registration > Overview

docs/auth/oauth2-proxy/provider.md

@@ -22,9 +22,17 @@ The provider configuration can be added to your `app-config.yaml` under the root
 auth:
   environment: development
   providers:
-    oauth2Proxy: {}
+    oauth2Proxy:
+      development:
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: forwardedUserMatchingUserEntityName
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 Right now no configuration options are supported, but the empty object is needed
 to enable the provider in the auth backend.
 

docs/auth/okta/provider.md

@@ -47,8 +47,15 @@ auth:
         idp: ${AUTH_OKTA_IDP} # Optional
         # https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned
         additionalScopes: ${AUTH_OKTA_ADDITIONAL_SCOPES} # Optional
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: emailMatchingUserEntityAnnotation
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The values referenced are found on the Application page on your Okta site.
 
 - `clientId`: The client ID that you generated on Okta, e.g.

docs/auth/vmware-cloud/provider.md

@@ -156,8 +156,15 @@ auth:
       development:
         clientId: ${APP_ID}
         organizationId: ${ORG_ID}
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: vmwareCloudSignInResolvers
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 where `APP_ID` refers to the ID retrieved when creating the OAuth App, and
 `ORG_ID` is the [long ID of the
 Organization](https://docs.vmware.com/en/VMware-Cloud-services/services/Using-VMware-Cloud-Services/GUID-CF9E9318-B811-48CF-8499-9419997DC1F8.html#view-the-organization-id-1)

docs/backend-system/building-backends/08-migrating.md

@@ -816,9 +816,9 @@ auth:
         tenantId: ${AZURE_TENANT_ID}
         signIn:
           resolvers:
-            - resolver: emailMatchingUserEntityAnnotation
             - resolver: emailMatchingUserEntityProfileEmail
             - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: emailMatchingUserEntityAnnotation
 ```
 
 > Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
@@ -848,7 +848,7 @@ Additional resolvers:
 
 - [usernameMatchingUserEntityName](https://github.com/backstage/backstage/blob/5447cffd23cf00772988fb799ced0ec5e54efb2e/plugins/auth-backend-module-atlassian-provider/src/resolvers.ts#L33C16-L33C46)
 
-##### GCP IAM
+##### GCP IAP (Google Identity-Aware Proxy)
 
 Setup: