diff --git a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md
index 1bdf9cc367..dca6f096c3 100644
--- a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md
+++ b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md
@@ -58,6 +58,7 @@ When using ALB authentication Backstage will only be loaded once the user has su
 import React from 'react';
 import { UserIdentity } from '@backstage/core-components';
 import { SignInPageProps } from '@backstage/core-app-api';
+import { useApi, configApiRef } from '@backstage/core-plugin-api';
 
 const SampleSignInComponent: any = (props: SignInPageProps) => {
   const [error, setError] = React.useState<string | undefined>();
@@ -135,12 +136,14 @@ export default async function createPlugin({
   database,
   config,
   discovery,
+  tokenManager,
 }: PluginEnvironment): Promise<Router> {
   return await createRouter({
     logger,
     config,
     database,
     discovery,
+    tokenManager,
     providerFactories: {
       awsalb: providers.awsAlb.create({
         authHandler: async ({ fullProfile }) => {
@@ -168,25 +171,29 @@ export default async function createPlugin({
           };
         },
         signIn: {
-          resolver: async ({ profile: { email } }, ctx) => {
-            const [id] = email?.split('@') ?? '';
-            // Fetch from an external system that returns entity claims like:
-            // ['user:default/breanna.davison', ...]
-            const userEntityRef = stringifyEntityRef({
+          resolver: async ({ profile }, ctx) => {
+            if (!profile.email) {
+              throw new Error('Profile contained no email');
+            }
+
+            const [id] = profile.email.split('@');
+            if (!id) {
+              throw new Error('Invalid email format');
+            }
+
+            const userRef = stringifyEntityRef({
               kind: 'User',
-              namespace: DEFAULT_NAMESPACE,
               name: id,
+              namespace: DEFAULT_NAMESPACE,
             });
 
-            // Resolve group membership from the Backstage catalog
-            const fullEnt =
-              await ctx.catalogIdentityClient.resolveCatalogMembership({
-                entityRefs: [id].concat([userEntityRef]),
-                logger: ctx.logger,
-              });
-            const token = await ctx.tokenIssuer.issueToken({
-              claims: { sub: userEntityRef, ent: fullEnt },
+            const { token } = await ctx.issueToken({
+              claims: {
+                sub: userRef,
+                ent: [userRef],
+              },
             });
+
             return { id, token };
           },
         },