From df6701a5d823425d5a08f0b5e73a02a86ca7c467 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 2 May 2022 12:18:43 +0200 Subject: [PATCH] docs/auth/troubleshooting: add sections for origin and user not found errors Signed-off-by: Patrik Oldsberg --- docs/auth/troubleshooting.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/docs/auth/troubleshooting.md b/docs/auth/troubleshooting.md index 6a57c75270..4c01ad207a 100644 --- a/docs/auth/troubleshooting.md +++ b/docs/auth/troubleshooting.md @@ -32,3 +32,24 @@ You can use the `yarn backstage-cli config:print --lax` command to print your lo The backend logs should also provide insight into why the configuration of the provider fails. In working setup the backend should log something like `"Configuring provider, oauth2"`, while it with otherwise log a warning like `"Skipping oauth2 auth provider, ..."`. + +## Auth fails with "Login failed; caused by NotAllowedError: Origin '...' is not allowed" + +This will happen if the origin of the configured `app.baseUrl` in the auth backend does not +match the origin that the frontend is being accessed at. Make sure that `app.baseUrl` matches +what a user sees in the browser address bar. + +If you wish to support multiple different origins at once, there is an experimental configuration +that lets you do this. The `auth.experimentalExtraAllowedOrigins` key accepts a list of origin +glob patterns where sign-in should be allowed from. + +## Sign-in fails with the error "User not found" + +Many built-in sign-in resolvers require user entities to be present in the catalog. This +error is encountered if authentication is successful, but a matching user entity is not +present in the catalog. If you wish to enable sign-in without having users be represented +in the catalog data, see the method that's documented in the +[sign-in resolver documentation](./identity-resolver.md#sign-in-without-users-in-the-catalog). + +If you want to customize this error message, you can create a custom sign-in resolver and +catch the `NotFoundError` thrown by `ctx.signInWithCatalogUser` or `ctx.findCatalogUser`.