From bae0120960ac5c0c7cb1dc3dc4d02b58731d456c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Mon, 19 Aug 2024 09:42:47 +0200 Subject: [PATCH] reveiw comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/eleven-dolphins-divide.md | 21 ++++++++++++++++++- .../api-report.md | 1 + 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/.changeset/eleven-dolphins-divide.md b/.changeset/eleven-dolphins-divide.md index b3f815dba6..a35702323c 100644 --- a/.changeset/eleven-dolphins-divide.md +++ b/.changeset/eleven-dolphins-divide.md @@ -2,4 +2,23 @@ '@backstage/plugin-auth-backend-module-aws-alb-provider': patch --- -Added a `signer` configuration option to validate against the token claims +Added a `signer` configuration option to validate against the token claims. We strongly recommend that you set this value (typically on the format `arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/app/my-load-balancer/1234567890123456`) to ensure that the auth provider can safely check the authenticity of any incoming tokens. + +Example: + +```diff + auth: + providers: + awsalb: + # this is the URL of the IdP you configured + issuer: 'https://example.okta.com/oauth2/default' + # this is the ARN of your ALB instance ++ signer: 'arn:aws:elasticloadbalancing:us-east-2:123456789012:loadbalancer/app/my-load-balancer/1234567890123456' + # this is the region where your ALB instance resides + region: 'us-west-2' + signIn: + resolvers: + # typically you would pick one of these + - resolver: emailMatchingUserEntityProfileEmail + - resolver: emailLocalPartMatchingUserEntityName +``` diff --git a/plugins/auth-backend-module-aws-alb-provider/api-report.md b/plugins/auth-backend-module-aws-alb-provider/api-report.md index 7f4531419a..78e7522069 100644 --- a/plugins/auth-backend-module-aws-alb-provider/api-report.md +++ b/plugins/auth-backend-module-aws-alb-provider/api-report.md @@ -21,6 +21,7 @@ export default authModuleAwsAlbProvider; export const awsAlbAuthenticator: ProxyAuthenticator< { issuer: string; + signer: string | undefined; getKey: (header: JWTHeaderParameters) => Promise; }, AwsAlbResult,