Merge pull request #6609 from stephane-mori/auth-backend-saml-clock-discrepancies

Auth backend saml clock discrepancies

.changeset/lazy-apples-scream.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Allow to configure SAML auth `acceptedClockSkewMs`

plugins/auth-backend/config.d.ts

@@ -53,6 +53,7 @@ export interface Config {
         decryptionPvk?: string;
         signatureAlgorithm?: 'sha256' | 'sha512';
         digestAlgorithm?: string;
+        acceptedClockSkewMs?: number;
       };
       okta?: {
         [authEnv: string]: { [key: string]: string };

plugins/auth-backend/src/providers/saml/provider.ts

@@ -132,6 +132,7 @@ export const createSamlProvider = (
         | SignatureAlgorithm
         | undefined,
       digestAlgorithm: config.getOptionalString('digestAlgorithm'),
+      acceptedClockSkewMs: config.getOptionalNumber('acceptedClockSkewMs'),
 
       tokenIssuer,
       appUrl: globalConfig.appUrl,