From ed92f732a1957ab77880bffaf649739e29815923 Mon Sep 17 00:00:00 2001
From: Brian Fletcher <brian@roadie.io>
Date: Thu, 25 Aug 2022 15:42:12 +0100
Subject: [PATCH] default id provider surface NotAllowedError

Signed-off-by: Brian Fletcher <brian@roadie.io>
---
 plugins/auth-node/src/DefaultIdentityClient.ts | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/plugins/auth-node/src/DefaultIdentityClient.ts b/plugins/auth-node/src/DefaultIdentityClient.ts
index 167b0c2451..8f51bd7530 100644
--- a/plugins/auth-node/src/DefaultIdentityClient.ts
+++ b/plugins/auth-node/src/DefaultIdentityClient.ts
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { AuthenticationError } from '@backstage/errors';
+import { AuthenticationError, NotAllowedError } from '@backstage/errors';
 import {
   createRemoteJWKSet,
   decodeJwt,
@@ -81,9 +81,13 @@ export class DefaultIdentityClient implements IdentityApi {
     if (!request.headers.authorization) {
       return undefined;
     }
-    return await this.authenticate(
-      getBearerTokenFromAuthorizationHeader(request.headers.authorization),
-    );
+    try {
+      return await this.authenticate(
+        getBearerTokenFromAuthorizationHeader(request.headers.authorization),
+      );
+    } catch (e) {
+      throw new NotAllowedError('Failed to authenticate the provided token');
+    }
   }
 
   /**