From ddb94bd241413ec1bbaf977cab7ddf6e7dbcd9e8 Mon Sep 17 00:00:00 2001 From: Marco Crivellaro Date: Sun, 20 Mar 2022 22:58:05 +0000 Subject: [PATCH 1/3] sub claim used by customm sign-in must be a full entity refrence Signed-off-by: Marco Crivellaro --- contrib/docs/tutorials/aws-alb-aad-oidc-auth.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md index a95b276365..91968f6b4f 100644 --- a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md +++ b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md @@ -154,16 +154,16 @@ export default async function createPlugin({ const [id] = email?.split('@') ?? ''; // Fetch from an external system that returns entity claims like: // ['user:default/breanna.davison', ...] - const ent = [`user:default/${id}`]; + const userEntityRef = `user:default/${id}`; // Resolve group membership from the Backstage catalog const fullEnt = await ctx.catalogIdentityClient.resolveCatalogMembership({ - entityRefs: [id].concat(ent), + entityRefs: [id].concat([userEntityRef]), logger: ctx.logger, }); const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: id, ent: fullEnt }, + claims: { sub: userEntityRef, ent: fullEnt }, }); return { id, token }; }, From e1b0db19086fda9b57fb567f1e90e92a7d53075b Mon Sep 17 00:00:00 2001 From: Marco Crivellaro Date: Mon, 21 Mar 2022 14:17:37 +0000 Subject: [PATCH 2/3] use stringifyEntityRef to build the user reference Signed-off-by: Marco Crivellaro --- contrib/docs/tutorials/aws-alb-aad-oidc-auth.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md index 91968f6b4f..50bff29a03 100644 --- a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md +++ b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md @@ -109,6 +109,10 @@ import { createRouter, createAwsAlbProvider, } from '@backstage/plugin-auth-backend'; +import { + DEFAULT_NAMESPACE, + stringifyEntityRef, +} from '@backstage/catalog-model'; import { Router } from 'express'; import { PluginEnvironment } from '../types'; @@ -154,7 +158,7 @@ export default async function createPlugin({ const [id] = email?.split('@') ?? ''; // Fetch from an external system that returns entity claims like: // ['user:default/breanna.davison', ...] - const userEntityRef = `user:default/${id}`; + const userEntityRef = stringifyEntityRef({ kind: 'User', namespace: DEFAULT_NAMESPACE, name: id }); // Resolve group membership from the Backstage catalog const fullEnt = From 74310dbb613236c02ceb78deda5830ab27ce3f0c Mon Sep 17 00:00:00 2001 From: Marco Crivellaro Date: Mon, 21 Mar 2022 14:44:45 +0000 Subject: [PATCH 3/3] chore: prettier Signed-off-by: Marco Crivellaro --- contrib/docs/tutorials/aws-alb-aad-oidc-auth.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md index 50bff29a03..52f7888fb8 100644 --- a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md +++ b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md @@ -158,7 +158,11 @@ export default async function createPlugin({ const [id] = email?.split('@') ?? ''; // Fetch from an external system that returns entity claims like: // ['user:default/breanna.davison', ...] - const userEntityRef = stringifyEntityRef({ kind: 'User', namespace: DEFAULT_NAMESPACE, name: id }); + const userEntityRef = stringifyEntityRef({ + kind: 'User', + namespace: DEFAULT_NAMESPACE, + name: id, + }); // Resolve group membership from the Backstage catalog const fullEnt =