Added SingIn Resolvers Config Details

Signed-off-by: Andre Wanlin <awanlin@spotify.com>

docs/auth/google/gcp-iap-auth.md

@@ -27,8 +27,15 @@ auth:
     gcp-iap:
       audience: '/projects/<project number>/global/backendServices/<backend service id>'
       jwtHeader: x-custom-header # Optional: Only if you are using a custom header for the IAP JWT
+      signIn:
+        resolvers:
+          - resolver: emailMatchingUserEntityProfileEmail
+          - resolver: emailLocalPartMatchingUserEntityName
+          - resolver: emailMatchingUserEntityAnnotation
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The full `audience` value can be obtained by visiting your [Identity-Aware Proxy Google Cloud console](https://console.cloud.google.com/security/iap), selecting your project, finding your Backend Service to proxy, clicking the 3 vertical dots then "Get JWT Audience Code", and copying from the resulting popup, which will look similar to the following:
 
 ![Identity-Aware Proxy JWT Audience Code popup](../../assets/auth/gcp-iap-jwt-audience-code-popup.png)
@@ -94,6 +101,27 @@ Now the backend is ready to serve auth requests on the
 `/api/auth/gcp-iap/refresh` endpoint. All that's left is to update the frontend
 sign-in mechanism to poll that endpoint through the IAP, on the user's behalf.
 
+### New Backend System
+
+There is a module for this provider that works with the new backend system.
+
+First you'll want to run this command to add the module:
+
+```sh
+ yarn --cwd packages/backend add @backstage/plugin-auth-backend-module-gcp-iap-provider
+```
+
+Then you will need to add this to your backend:
+
+```ts title="packages/backend/src/index.ts"
+const backend = createBackend();
+
+backend.add(import('@backstage/plugin-auth-backend'));
+/* highlight-add-start */
+backend.add(import('@backstage/plugin-auth-backend-module-gcp-iap-provider'));
+/* highlight-add-end */
+```
+
 ## Frontend Changes
 
 It is recommended to use the `ProxiedSignInPage` for this provider, which is

docs/auth/google/provider.md

@@ -42,8 +42,15 @@ auth:
       development:
         clientId: ${AUTH_GOOGLE_CLIENT_ID}
         clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET}
+        signIn:
+          resolvers:
+            - resolver: emailMatchingUserEntityProfileEmail
+            - resolver: emailLocalPartMatchingUserEntityName
+            - resolver: emailMatchingUserEntityAnnotation
 ```
 
+> Note: the resolvers will be tried in order, but will only be skipped if they throw a `NotFoundError`.
+
 The Google provider is a structure with two configuration keys:
 
 - `clientId`: The client ID that you generated, e.g.