Merge branch 'master' of https://github.com/backstage/backstage into fix-redirect-error-handling

plugins/auth-node/src/oauth/PassportOAuthAuthenticatorHelper.ts

@@ -85,12 +85,13 @@ export class PassportOAuthAuthenticatorHelper {
 
   async authenticate(
     input: OAuthAuthenticatorAuthenticateInput,
+    options?: Record<string, string>,
   ): Promise<OAuthAuthenticatorResult<PassportProfile>> {
     const { result, privateInfo } =
       await PassportHelpers.executeFrameHandlerStrategy<
         PassportOAuthResult,
         PassportOAuthPrivateInfo
-      >(input.req, this.#strategy);
+      >(input.req, this.#strategy, options);
 
     return {
       fullProfile: result.fullProfile as PassportProfile,

plugins/auth-node/src/oauth/createOAuthProviderFactory.ts

@@ -43,11 +43,10 @@ export function createOAuthProviderFactory<TProfile>(options: {
   return ctx => {
     return OAuthEnvironmentHandler.mapConfig(ctx.config, envConfig => {
       const signInResolver =
-        options.signInResolver ??
         readDeclarativeSignInResolver({
           config: envConfig,
           signInResolverFactories: options.signInResolverFactories ?? {},
-        });
+        }) ?? options.signInResolver;
 
       return createOAuthRouteHandlers<TProfile>({
         authenticator: options.authenticator,

plugins/auth-node/src/sign-in/commonSignInResolvers.ts

@@ -16,6 +16,11 @@
 
 import { createSignInResolverFactory } from './createSignInResolverFactory';
 
+// This splits an email "joe+work@acme.com" into ["joe", "+work", "@acme.com"]
+// so that we can remove the plus addressing. May output a shorter array:
+// ["joe", "@acme.com"], if no plus addressing was found.
+const reEmail = /^([^@+]+)(\+[^@]+)?(@.*)$/;
+
 /**
  * A collection of common sign-in resolvers that work with any auth provider.
  *
@@ -38,11 +43,30 @@ export namespace commonSignInResolvers {
             );
           }
 
-          return ctx.signInWithCatalogUser({
-            filter: {
-              'spec.profile.email': profile.email,
-            },
-          });
+          try {
+            return await ctx.signInWithCatalogUser({
+              filter: {
+                'spec.profile.email': profile.email,
+              },
+            });
+          } catch (err) {
+            if (err?.name === 'NotFoundError') {
+              // Try removing the plus addressing from the email address
+              const m = profile.email.match(reEmail);
+              if (m?.length === 4) {
+                const [_, name, _plus, domain] = m;
+                const noPlusEmail = `${name}${domain}`;
+
+                return ctx.signInWithCatalogUser({
+                  filter: {
+                    'spec.profile.email': noPlusEmail,
+                  },
+                });
+              }
+            }
+            // Email had no plus addressing or is missing in the catalog, forward failure
+            throw err;
+          }
         };
       },
     });

plugins/auth-node/src/sign-in/readDeclarativeSignInResolver.ts

@@ -66,6 +66,8 @@ export function readDeclarativeSignInResolver<TAuthResult>(
       }
     }
 
-    throw new Error('Failed to sign-in, unable to resolve user identity');
+    throw new Error(
+      'Failed to sign-in, unable to resolve user identity. Please verify that your catalog contains the expected User entities that would match your configured sign-in resolver.',
+    );
   };
 }