reveiw comments

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.changeset/eleven-dolphins-divide.md

@@ -2,4 +2,23 @@
 '@backstage/plugin-auth-backend-module-aws-alb-provider': patch
 ---
 
-Added a `signer` configuration option to validate against the token claims
+Added a `signer` configuration option to validate against the token claims. We strongly recommend that you set this value (typically on the format `arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/app/my-load-balancer/1234567890123456`) to ensure that the auth provider can safely check the authenticity of any incoming tokens.
+
+Example:
+
+```diff
+ auth:
+   providers:
+     awsalb:
+       # this is the URL of the IdP you configured
+       issuer: 'https://example.okta.com/oauth2/default'
+       # this is the ARN of your ALB instance
++      signer: 'arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/app/my-load-balancer/1234567890123456'
+       # this is the region where your ALB instance resides
+       region: 'us-west-2'
+       signIn:
+         resolvers:
+           # typically you would pick one of these
+           - resolver: emailMatchingUserEntityProfileEmail
+           - resolver: emailLocalPartMatchingUserEntityName
+```

plugins/auth-backend-module-aws-alb-provider/api-report.md

@@ -21,6 +21,7 @@ export default authModuleAwsAlbProvider;
 export const awsAlbAuthenticator: ProxyAuthenticator<
   {
     issuer: string;
+    signer: string | undefined;
     getKey: (header: JWTHeaderParameters) => Promise<KeyObject>;
   },
   AwsAlbResult,