auth providers will return entity ref as "sub" value

Signed-off-by: elonj <elonj@spotify.com>

plugins/auth-backend/src/providers/bitbucket/provider.ts

@@ -222,7 +222,7 @@ export const bitbucketUsernameSignInResolver: SignInResolver<BitbucketOAuthResul
     const claims = getEntityClaims(entity);
     const token = await ctx.tokenIssuer.issueToken({ claims });
 
-    return { id: entity.metadata.name, entity, token };
+    return { id: `user:default/${entity.metadata.name}`, entity, token };
   };
 
 export const bitbucketUserIdSignInResolver: SignInResolver<BitbucketOAuthResult> =
@@ -242,7 +242,7 @@ export const bitbucketUserIdSignInResolver: SignInResolver<BitbucketOAuthResult>
     const claims = getEntityClaims(entity);
     const token = await ctx.tokenIssuer.issueToken({ claims });
 
-    return { id: entity.metadata.name, entity, token };
+    return { id: `user:default/${entity.metadata.name}`, entity, token };
   };
 
 export type BitbucketProviderOptions = {

plugins/auth-backend/src/providers/github/provider.ts

@@ -191,7 +191,10 @@ export const githubDefaultSignInResolver: SignInResolver<GithubOAuthResult> =
     const userId = fullProfile.username || fullProfile.id;
 
     const token = await ctx.tokenIssuer.issueToken({
-      claims: { sub: userId, ent: [`user:default/${userId}`] },
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
     });
 
     return { id: userId, token };

plugins/auth-backend/src/providers/gitlab/provider.ts

@@ -72,7 +72,7 @@ export const gitlabDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   }
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: id, ent: [`user:default/${id}`] },
+    claims: { sub: `user:default/${id}`, ent: [`user:default/${id}`] },
   });
 
   return { id, token };

plugins/auth-backend/src/providers/google/provider.ts

@@ -198,7 +198,7 @@ export const googleEmailSignInResolver: SignInResolver<OAuthResult> = async (
   const claims = getEntityClaims(entity);
   const token = await ctx.tokenIssuer.issueToken({ claims });
 
-  return { id: entity.metadata.name, entity, token };
+  return { id: `user:default/${entity.metadata.name}`, entity, token };
 };
 
 const googleDefaultSignInResolver: SignInResolver<OAuthResult> = async (

plugins/auth-backend/src/providers/microsoft/provider.ts

@@ -217,7 +217,7 @@ export const microsoftEmailSignInResolver: SignInResolver<OAuthResult> = async (
   const claims = getEntityClaims(entity);
   const token = await ctx.tokenIssuer.issueToken({ claims });
 
-  return { id: entity.metadata.name, entity, token };
+  return { id: `user:default/${entity.metadata.name}`, entity, token };
 };
 
 export const microsoftDefaultSignInResolver: SignInResolver<OAuthResult> =
@@ -231,7 +231,10 @@ export const microsoftDefaultSignInResolver: SignInResolver<OAuthResult> =
     const userId = profile.email.split('@')[0];
 
     const token = await ctx.tokenIssuer.issueToken({
-      claims: { sub: userId, ent: [`user:default/${userId}`] },
+      claims: {
+        sub: `user:default/${userId}`,
+        ent: [`user:default/${userId}`],
+      },
     });
 
     return { id: userId, token };

plugins/auth-backend/src/providers/oauth2/provider.ts

@@ -211,7 +211,7 @@ export const oAuth2DefaultSignInResolver: SignInResolver<OAuthResult> = async (
   const userId = profile.email.split('@')[0];
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };

plugins/auth-backend/src/providers/okta/provider.ts

@@ -219,7 +219,7 @@ export const oktaEmailSignInResolver: SignInResolver<OAuthResult> = async (
   const claims = getEntityClaims(entity);
   const token = await ctx.tokenIssuer.issueToken({ claims });
 
-  return { id: entity.metadata.name, entity, token };
+  return { id: `user:default/${entity.metadata.name}`, entity, token };
 };
 
 export const oktaDefaultSignInResolver: SignInResolver<OAuthResult> = async (
@@ -236,7 +236,7 @@ export const oktaDefaultSignInResolver: SignInResolver<OAuthResult> = async (
   const userId = profile.email.split('@')[0];
 
   const token = await ctx.tokenIssuer.issueToken({
-    claims: { sub: userId, ent: [`user:default/${userId}`] },
+    claims: { sub: `user:default/${userId}`, ent: [`user:default/${userId}`] },
   });
 
   return { id: userId, token };