Merge pull request #9191 from backstage/auth-backend/full-ref-subs

Auth backend/full ref subs

.changeset/honest-rockets-sit.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': minor
+---
+
+The `sub` claim in Backstage tokens generated by the default Google and OIDC sign-in resolvers are now full entity references of the format `<kind>:<namespace>/<name>`.

plugins/auth-backend/src/providers/google/provider.ts

@@ -227,7 +227,7 @@ const googleDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   }
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };

plugins/auth-backend/src/providers/oidc/provider.ts

@@ -221,7 +221,10 @@ export const oAuth2DefaultSignInResolver: SignInResolver<
   }
   const userId = profile.email.split('@')[0];
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: {
+      sub: `user:default/${userId}`,
+      ent: [`user:default/${userId}`],
+    },
   });
   return { id: userId, token };
 };