diff --git a/.changeset/selfish-bags-punch.md b/.changeset/selfish-bags-punch.md new file mode 100644 index 0000000000..1950da9357 --- /dev/null +++ b/.changeset/selfish-bags-punch.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Added forwarding of the `audience` option for the SAML provider, making it possible to enable `audience` verification. diff --git a/plugins/auth-backend/config.d.ts b/plugins/auth-backend/config.d.ts index 25da7fa332..791bd3606b 100644 --- a/plugins/auth-backend/config.d.ts +++ b/plugins/auth-backend/config.d.ts @@ -75,6 +75,7 @@ export interface Config { logoutUrl?: string; issuer: string; cert: string; + audience?: string; privateKey?: string; authnContext?: string[]; identifierFormat?: string; diff --git a/plugins/auth-backend/src/providers/saml/provider.ts b/plugins/auth-backend/src/providers/saml/provider.ts index 07fc77e4f7..8929a1dbf0 100644 --- a/plugins/auth-backend/src/providers/saml/provider.ts +++ b/plugins/auth-backend/src/providers/saml/provider.ts @@ -125,6 +125,7 @@ export const createSamlProvider = ( callbackUrl: `${globalConfig.baseUrl}/${providerId}/handler/frame`, entryPoint: config.getString('entryPoint'), logoutUrl: config.getOptionalString('logoutUrl'), + audience: config.getOptionalString('audience'), issuer: config.getString('issuer'), cert: config.getString('cert'), privateCert: config.getOptionalString('privateKey'),