From ddb94bd241413ec1bbaf977cab7ddf6e7dbcd9e8 Mon Sep 17 00:00:00 2001 From: Marco Crivellaro Date: Sun, 20 Mar 2022 22:58:05 +0000 Subject: [PATCH] sub claim used by customm sign-in must be a full entity refrence Signed-off-by: Marco Crivellaro --- contrib/docs/tutorials/aws-alb-aad-oidc-auth.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md index a95b276365..91968f6b4f 100644 --- a/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md +++ b/contrib/docs/tutorials/aws-alb-aad-oidc-auth.md @@ -154,16 +154,16 @@ export default async function createPlugin({ const [id] = email?.split('@') ?? ''; // Fetch from an external system that returns entity claims like: // ['user:default/breanna.davison', ...] - const ent = [`user:default/${id}`]; + const userEntityRef = `user:default/${id}`; // Resolve group membership from the Backstage catalog const fullEnt = await ctx.catalogIdentityClient.resolveCatalogMembership({ - entityRefs: [id].concat(ent), + entityRefs: [id].concat([userEntityRef]), logger: ctx.logger, }); const token = await ctx.tokenIssuer.issueToken({ - claims: { sub: id, ent: fullEnt }, + claims: { sub: userEntityRef, ent: fullEnt }, }); return { id, token }; },