switch omitIdentityTokenOwnershipClaim to true

Signed-off-by: Fredrik Adelöw <freben@spotify.com>

plugins/auth-backend/config.d.ts

@@ -45,10 +45,16 @@ export interface Config {
 
     /**
      * Whether to omit the entity ownership references (`ent`) claim from the
-     * identity token. If this is enabled the `ent` claim will only be available
-     * via the user info endpoint and the `UserInfoService`.
+     * identity token.
      *
-     * Defaults to `false`.
+     * If this is disabled an `ent` claim will be included in the token
+     * containing all of the user's ownership refs as returned by the sign in
+     * resolver. This can in extreme cases lead to tokens that risk hitting HTTP
+     * header size limits. Setting it to `false` is therefore discouraged, and
+     * is only provided for backward compatibility reasons.
+     *
+     * Defaults to `true`, which means that the `ent` claim instead is available
+     * via the user info endpoint and the `UserInfoService`.
      */
     omitIdentityTokenOwnershipClaim?: boolean;
 

plugins/auth-backend/src/authPlugin.test.ts

@@ -100,7 +100,7 @@ describe('authPlugin', () => {
       const token = refreshRes.body.backstageIdentity.token;
       const decoded = JSON.parse(atob(token.split('.')[1]));
       expect(decoded.sub).toEqual(expectedIdentity.userEntityRef);
-      expect(decoded.ent).toEqual(expectedIdentity.ownershipEntityRefs);
+      expect('ent' in decoded).toBeFalsy();
 
       const userInfoRes = await request(server)
         .get('/api/auth/v1/userinfo')
@@ -115,7 +115,7 @@ describe('authPlugin', () => {
       });
     });
 
-    it('should omit ownership claims from the token when the config is set', async () => {
+    it('should include ownership claims in the token when the config is set to false', async () => {
       const { server } = await startTestBackend({
         features: [
           authPlugin,
@@ -127,7 +127,7 @@ describe('authPlugin', () => {
                 baseUrl: 'http://localhost',
               },
               auth: {
-                omitIdentityTokenOwnershipClaim: true,
+                omitIdentityTokenOwnershipClaim: false,
                 ...mockProvidersConfig,
               },
             },
@@ -149,7 +149,7 @@ describe('authPlugin', () => {
       const token = refreshRes.body.backstageIdentity.token;
       const decoded = JSON.parse(atob(token.split('.')[1]));
       expect(decoded.sub).toEqual(expectedIdentity.userEntityRef);
-      expect(decoded.ent).toBeUndefined();
+      expect(decoded.ent).toEqual(expectedIdentity.ownershipEntityRefs);
 
       const userInfoRes = await request(server)
         .get('/api/auth/v1/userinfo')

plugins/auth-backend/src/service/router.ts

@@ -87,11 +87,10 @@ export async function createRouter(
     database,
   });
 
-  const omitClaimsFromToken = config.getOptionalBoolean(
-    'auth.omitIdentityTokenOwnershipClaim',
-  )
-    ? ['ent']
-    : [];
+  const omitClaimsFromToken =
+    config.getOptionalBoolean('auth.omitIdentityTokenOwnershipClaim') ?? true
+      ? ['ent']
+      : [];
 
   let tokenIssuer: TokenIssuer;
   if (keyStore instanceof StaticKeyStore) {