paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 41 Packages Projects Releases Wiki Activity

switch omitIdentityTokenOwnershipClaim to true

Browse Source 
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
This commit is contained in:
Fredrik Adelöw
2026-03-18 22:10:50 +01:00
parent 7d86248253
commit d7c67cddf5
5 changed files with 28 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/shy-doors-repair.md
+11
View File
@@ -0,0 +1,11 @@
---
'@backstage/plugin-auth-backend': minor
---
**BREAKING**: The setting `auth.omitIdentityTokenOwnershipClaim` has had its default value switched to `true`.
With this setting Backstage user tokens issued by the `auth` backend will no longer contain an `ent` claim - the one with the user's ownership entity refs. This means that tokens issued in large orgs no longer risk hitting HTTP header size limits.
To get ownership info for the current user, code should use the `userInfo` core service. In practice code will typically already conform to this since the `ent` claim has not been readily exposed in any other way for quite some time. But code which explicitly decodes Backstage tokens - which is strongly discouraged - may be affected by this change.
The setting will remain for some time to allow it to be set back to `false` if need be, but it will be removed entirely in a future release.