Merge branch 'master' of https://github.com/backstage/backstage into fix-redirect-error-handling

plugins/auth-node/CHANGELOG.md

@@ -1,5 +1,139 @@
 # @backstage/plugin-auth-node
 
+## 0.5.3-next.0
+
+### Patch Changes
+
+- 094eaa3: Remove references to in-repo backend-common
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.0.1-next.0
+  - @backstage/catalog-client@1.7.0
+  - @backstage/catalog-model@1.7.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.2
+
+### Patch Changes
+
+- c46eb0f: Extend the "unable to resolve user identity" message
+- d908d8c: Accepts an optional options object in the `PassportOAuthAuthenticatorHelper.authenticate` method.
+- c2b63ab: Updated dependency `supertest` to `^7.0.0`.
+- 6f409b7: The `emailMatchingUserEntityProfileEmail` sign-in resolver will now also try matching emails with plus addressing removed.
+- Updated dependencies
+  - @backstage/backend-common@0.25.0
+  - @backstage/backend-plugin-api@1.0.0
+  - @backstage/catalog-model@1.7.0
+  - @backstage/catalog-client@1.7.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.2-next.2
+
+### Patch Changes
+
+- d908d8c: Accepts an optional options object in the `PassportOAuthAuthenticatorHelper.authenticate` method.
+- c2b63ab: Updated dependency `supertest` to `^7.0.0`.
+- Updated dependencies
+  - @backstage/backend-common@0.25.0-next.2
+  - @backstage/backend-plugin-api@1.0.0-next.2
+  - @backstage/catalog-client@1.7.0-next.1
+  - @backstage/catalog-model@1.6.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.2-next.1
+
+### Patch Changes
+
+- c46eb0f: Extend the "unable to resolve user identity" message
+- Updated dependencies
+  - @backstage/backend-common@0.25.0-next.1
+  - @backstage/catalog-client@1.6.7-next.0
+  - @backstage/backend-plugin-api@0.9.0-next.1
+  - @backstage/catalog-model@1.6.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.2-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@0.9.0-next.0
+  - @backstage/backend-common@0.25.0-next.0
+  - @backstage/catalog-client@1.6.6
+  - @backstage/catalog-model@1.6.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.0
+
+### Minor Changes
+
+- 579afd0: **BREAKING**: Sign-in resolvers configured via `.signIn.resolvers` now take precedence over sign-in resolvers passed to `signInResolver` option of `createOAuthProviderFactory`. This effectively makes sign-in resolvers passed via the `signInResolver` the default one, which you can then override through configuration.
+
+### Patch Changes
+
+- 93095ee: Make sure node-fetch is version 2.7.0 or greater
+- Updated dependencies
+  - @backstage/backend-plugin-api@0.8.0
+  - @backstage/backend-common@0.24.0
+  - @backstage/catalog-model@1.6.0
+  - @backstage/catalog-client@1.6.6
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.0-next.3
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@0.8.0-next.3
+  - @backstage/backend-common@0.23.4-next.3
+  - @backstage/catalog-model@1.6.0-next.0
+  - @backstage/catalog-client@1.6.6-next.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.5.0-next.2
+
+### Minor Changes
+
+- 579afd0: **BREAKING**: Sign-in resolvers configured via `.signIn.resolvers` now take precedence over sign-in resolvers passed to `signInResolver` option of `createOAuthProviderFactory`. This effectively makes sign-in resolvers passed via the `signInResolver` the default one, which you can then override through configuration.
+
+### Patch Changes
+
+- 93095ee: Make sure node-fetch is version 2.7.0 or greater
+- Updated dependencies
+  - @backstage/backend-plugin-api@0.8.0-next.2
+  - @backstage/backend-common@0.23.4-next.2
+  - @backstage/catalog-client@1.6.5
+  - @backstage/catalog-model@1.5.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
+## 0.4.18-next.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-plugin-api@0.7.1-next.1
+  - @backstage/backend-common@0.23.4-next.1
+  - @backstage/catalog-client@1.6.5
+  - @backstage/catalog-model@1.5.0
+  - @backstage/config@1.2.0
+  - @backstage/errors@1.2.4
+  - @backstage/types@1.1.1
+
 ## 0.4.18-next.0
 
 ### Patch Changes

plugins/auth-node/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-node",
-  "version": "0.4.18-next.0",
+  "version": "0.5.3-next.0",
   "backstage": {
     "role": "node-library",
     "pluginId": "auth",
@@ -37,7 +37,7 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-common": "workspace:^",
+    "@backstage/backend-common": "^0.25.0",
     "@backstage/backend-plugin-api": "workspace:^",
     "@backstage/catalog-client": "workspace:^",
     "@backstage/catalog-model": "workspace:^",
@@ -49,7 +49,7 @@
     "express": "^4.17.1",
     "jose": "^5.0.0",
     "lodash": "^4.17.21",
-    "node-fetch": "^2.6.7",
+    "node-fetch": "^2.7.0",
     "passport": "^0.7.0",
     "winston": "^3.2.1",
     "zod": "^3.22.4",
@@ -62,7 +62,7 @@
     "express-promise-router": "^4.1.1",
     "lodash": "^4.17.21",
     "msw": "^1.0.0",
-    "supertest": "^6.1.3",
+    "supertest": "^7.0.0",
     "uuid": "^9.0.0"
   }
 }

plugins/auth-node/report.api.md

@@ -503,6 +503,7 @@ export class PassportOAuthAuthenticatorHelper {
   // (undocumented)
   authenticate(
     input: OAuthAuthenticatorAuthenticateInput,
+    options?: Record<string, string>,
   ): Promise<OAuthAuthenticatorResult<PassportProfile>>;
   // (undocumented)
   static defaultProfileTransform: ProfileTransform<
@@ -702,4 +703,128 @@ export type WebMessageResponse =
       type: 'authorization_response';
       error: Error;
     };
+
+// Warnings were encountered during analysis:
+//
+// src/extensions/AuthOwnershipResolutionExtensionPoint.d.ts:3:1 - (ae-undocumented) Missing documentation for "AuthOwnershipResolutionExtensionPoint".
+// src/extensions/AuthOwnershipResolutionExtensionPoint.d.ts:4:5 - (ae-undocumented) Missing documentation for "setAuthOwnershipResolver".
+// src/extensions/AuthOwnershipResolutionExtensionPoint.d.ts:7:22 - (ae-undocumented) Missing documentation for "authOwnershipResolutionExtensionPoint".
+// src/extensions/AuthProvidersExtensionPoint.d.ts:3:1 - (ae-undocumented) Missing documentation for "AuthProviderRegistrationOptions".
+// src/extensions/AuthProvidersExtensionPoint.d.ts:4:5 - (ae-undocumented) Missing documentation for "providerId".
+// src/extensions/AuthProvidersExtensionPoint.d.ts:5:5 - (ae-undocumented) Missing documentation for "factory".
+// src/extensions/AuthProvidersExtensionPoint.d.ts:8:1 - (ae-undocumented) Missing documentation for "AuthProvidersExtensionPoint".
+// src/extensions/AuthProvidersExtensionPoint.d.ts:9:5 - (ae-undocumented) Missing documentation for "registerProvider".
+// src/extensions/AuthProvidersExtensionPoint.d.ts:12:22 - (ae-undocumented) Missing documentation for "authProvidersExtensionPoint".
+// src/flow/sendWebMessageResponse.d.ts:17:1 - (ae-undocumented) Missing documentation for "sendWebMessageResponse".
+// src/identity/DefaultIdentityClient.d.ts:35:5 - (ae-undocumented) Missing documentation for "getIdentity".
+// src/identity/IdentityClient.d.ts:13:5 - (ae-undocumented) Missing documentation for "create".
+// src/oauth/OAuthEnvironmentHandler.d.ts:5:1 - (ae-undocumented) Missing documentation for "OAuthEnvironmentHandler".
+// src/oauth/OAuthEnvironmentHandler.d.ts:7:5 - (ae-undocumented) Missing documentation for "mapConfig".
+// src/oauth/OAuthEnvironmentHandler.d.ts:9:5 - (ae-undocumented) Missing documentation for "start".
+// src/oauth/OAuthEnvironmentHandler.d.ts:10:5 - (ae-undocumented) Missing documentation for "frameHandler".
+// src/oauth/OAuthEnvironmentHandler.d.ts:11:5 - (ae-undocumented) Missing documentation for "refresh".
+// src/oauth/OAuthEnvironmentHandler.d.ts:12:5 - (ae-undocumented) Missing documentation for "logout".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:6:1 - (ae-undocumented) Missing documentation for "PassportOAuthResult".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:17:1 - (ae-undocumented) Missing documentation for "PassportOAuthPrivateInfo".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:21:1 - (ae-undocumented) Missing documentation for "PassportOAuthDoneCallback".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:23:1 - (ae-undocumented) Missing documentation for "PassportOAuthAuthenticatorHelper".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:25:5 - (ae-undocumented) Missing documentation for "defaultProfileTransform".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:26:5 - (ae-undocumented) Missing documentation for "from".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:28:5 - (ae-undocumented) Missing documentation for "start".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:32:5 - (ae-undocumented) Missing documentation for "authenticate".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:33:5 - (ae-undocumented) Missing documentation for "refresh".
+// src/oauth/PassportOAuthAuthenticatorHelper.d.ts:34:5 - (ae-undocumented) Missing documentation for "fetchProfile".
+// src/oauth/createOAuthProviderFactory.d.ts:6:1 - (ae-undocumented) Missing documentation for "createOAuthProviderFactory".
+// src/oauth/createOAuthRouteHandlers.d.ts:6:1 - (ae-undocumented) Missing documentation for "OAuthRouteHandlersOptions".
+// src/oauth/createOAuthRouteHandlers.d.ts:7:5 - (ae-undocumented) Missing documentation for "authenticator".
+// src/oauth/createOAuthRouteHandlers.d.ts:8:5 - (ae-undocumented) Missing documentation for "appUrl".
+// src/oauth/createOAuthRouteHandlers.d.ts:9:5 - (ae-undocumented) Missing documentation for "baseUrl".
+// src/oauth/createOAuthRouteHandlers.d.ts:10:5 - (ae-undocumented) Missing documentation for "isOriginAllowed".
+// src/oauth/createOAuthRouteHandlers.d.ts:11:5 - (ae-undocumented) Missing documentation for "providerId".
+// src/oauth/createOAuthRouteHandlers.d.ts:12:5 - (ae-undocumented) Missing documentation for "config".
+// src/oauth/createOAuthRouteHandlers.d.ts:13:5 - (ae-undocumented) Missing documentation for "resolverContext".
+// src/oauth/createOAuthRouteHandlers.d.ts:14:5 - (ae-undocumented) Missing documentation for "additionalScopes".
+// src/oauth/createOAuthRouteHandlers.d.ts:15:5 - (ae-undocumented) Missing documentation for "stateTransform".
+// src/oauth/createOAuthRouteHandlers.d.ts:16:5 - (ae-undocumented) Missing documentation for "profileTransform".
+// src/oauth/createOAuthRouteHandlers.d.ts:17:5 - (ae-undocumented) Missing documentation for "cookieConfigurer".
+// src/oauth/createOAuthRouteHandlers.d.ts:18:5 - (ae-undocumented) Missing documentation for "signInResolver".
+// src/oauth/createOAuthRouteHandlers.d.ts:21:1 - (ae-undocumented) Missing documentation for "createOAuthRouteHandlers".
+// src/oauth/state.d.ts:16:1 - (ae-undocumented) Missing documentation for "OAuthStateTransform".
+// src/oauth/state.d.ts:22:1 - (ae-undocumented) Missing documentation for "encodeOAuthState".
+// src/oauth/state.d.ts:24:1 - (ae-undocumented) Missing documentation for "decodeOAuthState".
+// src/oauth/types.d.ts:5:1 - (ae-undocumented) Missing documentation for "OAuthSession".
+// src/oauth/types.d.ts:6:5 - (ae-undocumented) Missing documentation for "accessToken".
+// src/oauth/types.d.ts:7:5 - (ae-undocumented) Missing documentation for "tokenType".
+// src/oauth/types.d.ts:8:5 - (ae-undocumented) Missing documentation for "idToken".
+// src/oauth/types.d.ts:9:5 - (ae-undocumented) Missing documentation for "scope".
+// src/oauth/types.d.ts:10:5 - (ae-undocumented) Missing documentation for "expiresInSeconds".
+// src/oauth/types.d.ts:11:5 - (ae-undocumented) Missing documentation for "refreshToken".
+// src/oauth/types.d.ts:12:5 - (ae-undocumented) Missing documentation for "refreshTokenExpiresInSeconds".
+// src/oauth/types.d.ts:15:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticatorScopeOptions".
+// src/oauth/types.d.ts:16:5 - (ae-undocumented) Missing documentation for "persist".
+// src/oauth/types.d.ts:17:5 - (ae-undocumented) Missing documentation for "required".
+// src/oauth/types.d.ts:18:5 - (ae-undocumented) Missing documentation for "transform".
+// src/oauth/types.d.ts:30:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticatorStartInput".
+// src/oauth/types.d.ts:31:5 - (ae-undocumented) Missing documentation for "scope".
+// src/oauth/types.d.ts:32:5 - (ae-undocumented) Missing documentation for "state".
+// src/oauth/types.d.ts:33:5 - (ae-undocumented) Missing documentation for "req".
+// src/oauth/types.d.ts:36:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticatorAuthenticateInput".
+// src/oauth/types.d.ts:37:5 - (ae-undocumented) Missing documentation for "req".
+// src/oauth/types.d.ts:40:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticatorRefreshInput".
+// src/oauth/types.d.ts:41:5 - (ae-undocumented) Missing documentation for "scope".
+// src/oauth/types.d.ts:42:5 - (ae-undocumented) Missing documentation for "refreshToken".
+// src/oauth/types.d.ts:43:5 - (ae-undocumented) Missing documentation for "req".
+// src/oauth/types.d.ts:46:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticatorLogoutInput".
+// src/oauth/types.d.ts:47:5 - (ae-undocumented) Missing documentation for "accessToken".
+// src/oauth/types.d.ts:48:5 - (ae-undocumented) Missing documentation for "refreshToken".
+// src/oauth/types.d.ts:49:5 - (ae-undocumented) Missing documentation for "req".
+// src/oauth/types.d.ts:52:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticatorResult".
+// src/oauth/types.d.ts:53:5 - (ae-undocumented) Missing documentation for "fullProfile".
+// src/oauth/types.d.ts:54:5 - (ae-undocumented) Missing documentation for "session".
+// src/oauth/types.d.ts:57:1 - (ae-undocumented) Missing documentation for "OAuthAuthenticator".
+// src/oauth/types.d.ts:58:5 - (ae-undocumented) Missing documentation for "defaultProfileTransform".
+// src/oauth/types.d.ts:60:5 - (ae-undocumented) Missing documentation for "shouldPersistScopes".
+// src/oauth/types.d.ts:61:5 - (ae-undocumented) Missing documentation for "scopes".
+// src/oauth/types.d.ts:62:5 - (ae-undocumented) Missing documentation for "initialize".
+// src/oauth/types.d.ts:66:5 - (ae-undocumented) Missing documentation for "start".
+// src/oauth/types.d.ts:70:5 - (ae-undocumented) Missing documentation for "authenticate".
+// src/oauth/types.d.ts:71:5 - (ae-undocumented) Missing documentation for "refresh".
+// src/oauth/types.d.ts:72:5 - (ae-undocumented) Missing documentation for "logout".
+// src/oauth/types.d.ts:75:1 - (ae-undocumented) Missing documentation for "createOAuthAuthenticator".
+// src/passport/PassportHelpers.d.ts:6:1 - (ae-undocumented) Missing documentation for "PassportHelpers".
+// src/passport/PassportHelpers.d.ts:8:5 - (ae-undocumented) Missing documentation for "transformProfile".
+// src/passport/PassportHelpers.d.ts:9:5 - (ae-undocumented) Missing documentation for "executeRedirectStrategy".
+// src/passport/PassportHelpers.d.ts:19:5 - (ae-undocumented) Missing documentation for "executeFrameHandlerStrategy".
+// src/passport/PassportHelpers.d.ts:23:5 - (ae-undocumented) Missing documentation for "executeRefreshTokenStrategy".
+// src/passport/PassportHelpers.d.ts:34:5 - (ae-undocumented) Missing documentation for "executeFetchUserProfileStrategy".
+// src/passport/types.d.ts:3:1 - (ae-undocumented) Missing documentation for "PassportProfile".
+// src/passport/types.d.ts:9:1 - (ae-undocumented) Missing documentation for "PassportDoneCallback".
+// src/proxy/createProxyAuthProviderFactory.d.ts:5:1 - (ae-undocumented) Missing documentation for "createProxyAuthProviderFactory".
+// src/proxy/createProxyRouteHandlers.d.ts:5:1 - (ae-undocumented) Missing documentation for "ProxyAuthRouteHandlersOptions".
+// src/proxy/createProxyRouteHandlers.d.ts:6:5 - (ae-undocumented) Missing documentation for "authenticator".
+// src/proxy/createProxyRouteHandlers.d.ts:7:5 - (ae-undocumented) Missing documentation for "config".
+// src/proxy/createProxyRouteHandlers.d.ts:8:5 - (ae-undocumented) Missing documentation for "resolverContext".
+// src/proxy/createProxyRouteHandlers.d.ts:9:5 - (ae-undocumented) Missing documentation for "signInResolver".
+// src/proxy/createProxyRouteHandlers.d.ts:10:5 - (ae-undocumented) Missing documentation for "profileTransform".
+// src/proxy/createProxyRouteHandlers.d.ts:13:1 - (ae-undocumented) Missing documentation for "createProxyAuthRouteHandlers".
+// src/proxy/types.d.ts:5:1 - (ae-undocumented) Missing documentation for "ProxyAuthenticator".
+// src/proxy/types.d.ts:6:5 - (ae-undocumented) Missing documentation for "defaultProfileTransform".
+// src/proxy/types.d.ts:7:5 - (ae-undocumented) Missing documentation for "initialize".
+// src/proxy/types.d.ts:10:5 - (ae-undocumented) Missing documentation for "authenticate".
+// src/proxy/types.d.ts:18:1 - (ae-undocumented) Missing documentation for "createProxyAuthenticator".
+// src/sign-in/createSignInResolverFactory.d.ts:5:1 - (ae-undocumented) Missing documentation for "SignInResolverFactory".
+// src/sign-in/createSignInResolverFactory.d.ts:6:5 - (ae-undocumented) Missing documentation for "__call".
+// src/sign-in/createSignInResolverFactory.d.ts:7:5 - (ae-undocumented) Missing documentation for "optionsJsonSchema".
+// src/sign-in/createSignInResolverFactory.d.ts:10:1 - (ae-undocumented) Missing documentation for "SignInResolverFactoryOptions".
+// src/sign-in/createSignInResolverFactory.d.ts:11:5 - (ae-undocumented) Missing documentation for "optionsSchema".
+// src/sign-in/createSignInResolverFactory.d.ts:12:5 - (ae-undocumented) Missing documentation for "create".
+// src/sign-in/createSignInResolverFactory.d.ts:15:1 - (ae-undocumented) Missing documentation for "createSignInResolverFactory".
+// src/sign-in/readDeclarativeSignInResolver.d.ts:5:1 - (ae-undocumented) Missing documentation for "ReadDeclarativeSignInResolverOptions".
+// src/sign-in/readDeclarativeSignInResolver.d.ts:6:5 - (ae-undocumented) Missing documentation for "config".
+// src/sign-in/readDeclarativeSignInResolver.d.ts:7:5 - (ae-undocumented) Missing documentation for "signInResolverFactories".
+// src/sign-in/readDeclarativeSignInResolver.d.ts:12:1 - (ae-undocumented) Missing documentation for "readDeclarativeSignInResolver".
+// src/types.d.ts:139:5 - (ae-undocumented) Missing documentation for "resolveOwnershipEntityRefs".
+// src/types.d.ts:204:1 - (ae-undocumented) Missing documentation for "AuthProviderConfig".
+// src/types.d.ts:224:1 - (ae-undocumented) Missing documentation for "AuthProviderFactory".
+// src/types.d.ts:250:1 - (ae-undocumented) Missing documentation for "ClientAuthResponse".
 ```

plugins/auth-node/src/oauth/PassportOAuthAuthenticatorHelper.ts

@@ -85,12 +85,13 @@ export class PassportOAuthAuthenticatorHelper {
 
   async authenticate(
     input: OAuthAuthenticatorAuthenticateInput,
+    options?: Record<string, string>,
   ): Promise<OAuthAuthenticatorResult<PassportProfile>> {
     const { result, privateInfo } =
       await PassportHelpers.executeFrameHandlerStrategy<
         PassportOAuthResult,
         PassportOAuthPrivateInfo
-      >(input.req, this.#strategy);
+      >(input.req, this.#strategy, options);
 
     return {
       fullProfile: result.fullProfile as PassportProfile,

plugins/auth-node/src/oauth/createOAuthProviderFactory.ts

@@ -43,11 +43,10 @@ export function createOAuthProviderFactory<TProfile>(options: {
   return ctx => {
     return OAuthEnvironmentHandler.mapConfig(ctx.config, envConfig => {
       const signInResolver =
-        options.signInResolver ??
         readDeclarativeSignInResolver({
           config: envConfig,
           signInResolverFactories: options.signInResolverFactories ?? {},
-        });
+        }) ?? options.signInResolver;
 
       return createOAuthRouteHandlers<TProfile>({
         authenticator: options.authenticator,

plugins/auth-node/src/sign-in/commonSignInResolvers.ts

@@ -16,6 +16,11 @@
 
 import { createSignInResolverFactory } from './createSignInResolverFactory';
 
+// This splits an email "joe+work@acme.com" into ["joe", "+work", "@acme.com"]
+// so that we can remove the plus addressing. May output a shorter array:
+// ["joe", "@acme.com"], if no plus addressing was found.
+const reEmail = /^([^@+]+)(\+[^@]+)?(@.*)$/;
+
 /**
  * A collection of common sign-in resolvers that work with any auth provider.
  *
@@ -38,11 +43,30 @@ export namespace commonSignInResolvers {
             );
           }
 
-          return ctx.signInWithCatalogUser({
-            filter: {
-              'spec.profile.email': profile.email,
-            },
-          });
+          try {
+            return await ctx.signInWithCatalogUser({
+              filter: {
+                'spec.profile.email': profile.email,
+              },
+            });
+          } catch (err) {
+            if (err?.name === 'NotFoundError') {
+              // Try removing the plus addressing from the email address
+              const m = profile.email.match(reEmail);
+              if (m?.length === 4) {
+                const [_, name, _plus, domain] = m;
+                const noPlusEmail = `${name}${domain}`;
+
+                return ctx.signInWithCatalogUser({
+                  filter: {
+                    'spec.profile.email': noPlusEmail,
+                  },
+                });
+              }
+            }
+            // Email had no plus addressing or is missing in the catalog, forward failure
+            throw err;
+          }
         };
       },
     });

plugins/auth-node/src/sign-in/readDeclarativeSignInResolver.ts

@@ -66,6 +66,8 @@ export function readDeclarativeSignInResolver<TAuthResult>(
       }
     }
 
-    throw new Error('Failed to sign-in, unable to resolve user identity');
+    throw new Error(
+      'Failed to sign-in, unable to resolve user identity. Please verify that your catalog contains the expected User entities that would match your configured sign-in resolver.',
+    );
   };
 }