@backstage/plugin-auth-backend-module-openshift-provider 0.0.0-nightly-20250910023713

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# @backstage/plugin-auth-backend-module-openshift-provider
+
+## 0.0.0-nightly-20250910023713
+
+### Minor Changes
+
+- 5a84253: Add new `auth-backend-module-openshift-provider`. This authentication provider enables Backstage to sign in with OpenShift.
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.0.0-nightly-20250910023713
+  - @backstage/backend-plugin-api@0.0.0-nightly-20250910023713
+  - @backstage/catalog-model@1.7.5
+  - @backstage/types@1.2.1

package/README.md

@@ -0,0 +1,5 @@
+# @backstage/plugin-auth-backend-module-openshift-provider
+
+The openshift-provider backend module for the auth plugin.
+
+_This plugin was created through the Backstage CLI_

package/config.d.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2025 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { HumanDuration } from '@backstage/types';
+
+export interface Config {
+  auth?: {
+    providers?: {
+      /** @visibility frontend */
+      openshift?: {
+        [authEnv: string]: {
+          clientId: string;
+          /**
+           * @visibility secret
+           */
+          clientSecret: string;
+          authorizationUrl: string;
+          tokenUrl: string;
+          callbackUrl?: string;
+          openshiftApiServerUrl: string;
+          signIn?: {
+            resolvers: Array<{
+              resolver: 'displayNameMatchingUserEntityName';
+              dangerouslyAllowSignInWithoutUserInCatalog?: boolean;
+            }>;
+          };
+          sessionDuration?: HumanDuration | string;
+        };
+      };
+    };
+  };
+}

package/dist/authenticator.cjs.js

@@ -0,0 +1,121 @@
+'use strict';
+
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var node_crypto = require('node:crypto');
+var OAuth2Strategy = require('passport-oauth2');
+var zod = require('zod');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var OAuth2Strategy__default = /*#__PURE__*/_interopDefaultCompat(OAuth2Strategy);
+
+const OpenShiftUser = zod.z.object({
+  metadata: zod.z.object({
+    name: zod.z.string()
+  })
+});
+const openshiftAuthenticator = pluginAuthNode.createOAuthAuthenticator({
+  defaultProfileTransform: pluginAuthNode.PassportOAuthAuthenticatorHelper.defaultProfileTransform,
+  scopes: {
+    required: ["user:full"]
+  },
+  initialize({ callbackUrl, config }) {
+    const clientId = config.getString("clientId");
+    const clientSecret = config.getString("clientSecret");
+    const authorizationUrl = config.getString("authorizationUrl");
+    const tokenUrl = config.getString("tokenUrl");
+    const openshiftApiServerUrl = config.getString("openshiftApiServerUrl");
+    const strategy = new OAuth2Strategy__default.default(
+      {
+        clientID: clientId,
+        clientSecret,
+        callbackURL: callbackUrl,
+        authorizationURL: authorizationUrl,
+        tokenURL: tokenUrl,
+        passReqToCallback: false
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, { fullProfile, params, accessToken }, { refreshToken });
+      }
+    );
+    strategy.userProfile = function userProfile(accessToken, done) {
+      this._oauth2.useAuthorizationHeaderforGET(true);
+      this._oauth2.get(
+        `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,
+        accessToken,
+        (error, data, _) => {
+          if (error !== null && error.statusCode !== 200) {
+            done(new Error(`HTTP error! Status: ${error.statusCode}`));
+            return;
+          }
+          if (!data) {
+            done(new Error("No data provided!"));
+            return;
+          }
+          if (typeof data !== "string") {
+            done(new Error("Data of type Buffer is not supported!"));
+            return;
+          }
+          const user = OpenShiftUser.parse(JSON.parse(data));
+          done(null, { displayName: user.metadata.name });
+        }
+      );
+    };
+    return {
+      openshiftApiServerUrl,
+      helper: pluginAuthNode.PassportOAuthAuthenticatorHelper.from(strategy)
+    };
+  },
+  async start(input, { helper }) {
+    return helper.start(input, {
+      accessType: "offline",
+      prompt: "consent"
+    });
+  },
+  async authenticate(input, { helper }) {
+    const { fullProfile, session } = await helper.authenticate(input);
+    session.refreshToken = session.accessToken;
+    session.refreshTokenExpiresInSeconds = session.expiresInSeconds;
+    return { fullProfile, session };
+  },
+  async refresh(input, { helper }) {
+    const accessToken = input.refreshToken;
+    const fullProfile = await helper.fetchProfile(accessToken).catch((error) => {
+      if (error.oauthError?.statusCode === 401) {
+        throw new Error("Invalid access token");
+      }
+      throw error;
+    });
+    return {
+      fullProfile,
+      session: {
+        accessToken,
+        tokenType: "bearer",
+        scope: input.scope,
+        refreshToken: input.refreshToken
+      }
+    };
+  },
+  async logout(input, { openshiftApiServerUrl, helper }) {
+    const accessToken = input.refreshToken;
+    if (!accessToken) {
+      throw new Error("access token/refresh token needs to be set for logout");
+    }
+    try {
+      await helper.fetchProfile(accessToken);
+    } catch {
+      return;
+    }
+    const tokenName = node_crypto.createHash("sha256").update(accessToken.slice("sha256~".length)).digest().toString("base64url");
+    const response = await fetch(
+      `${openshiftApiServerUrl}/apis/oauth.openshift.io/v1/oauthaccesstokens/sha256~${tokenName}`,
+      { method: "DELETE", headers: { Authorization: `Bearer ${accessToken}` } }
+    );
+    if (response.status === 401) {
+      throw new Error("unauthorized");
+    }
+  }
+});
+
+exports.openshiftAuthenticator = openshiftAuthenticator;
+//# sourceMappingURL=authenticator.cjs.js.map

package/dist/authenticator.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.cjs.js","sources":["../src/authenticator.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createOAuthAuthenticator,\n  PassportOAuthAuthenticatorHelper,\n  PassportOAuthDoneCallback,\n  PassportProfile,\n} from '@backstage/plugin-auth-node';\nimport { createHash } from 'node:crypto';\nimport OAuth2Strategy from 'passport-oauth2';\nimport { z } from 'zod';\n\n/** @public */\nexport interface OpenShiftAuthenticatorContext {\n  openshiftApiServerUrl: string;\n  helper: PassportOAuthAuthenticatorHelper;\n}\n\n/** @private\n * Schema for user.openshift.io/v1,\n * see https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/user_and_group_apis/user-user-openshift-io-v1#user-user-openshift-io-v1\n */\nconst OpenShiftUser = z.object({\n  metadata: z.object({\n    name: z.string(),\n  }),\n});\n\n/** @public */\nexport const openshiftAuthenticator = createOAuthAuthenticator<\n  OpenShiftAuthenticatorContext,\n  PassportProfile\n>({\n  defaultProfileTransform:\n    PassportOAuthAuthenticatorHelper.defaultProfileTransform,\n  scopes: {\n    required: ['user:full'],\n  },\n  initialize({ callbackUrl, config }) {\n    const clientId = config.getString('clientId');\n    const clientSecret = config.getString('clientSecret');\n    const authorizationUrl = config.getString('authorizationUrl');\n    const tokenUrl = config.getString('tokenUrl');\n    const openshiftApiServerUrl = config.getString('openshiftApiServerUrl');\n\n    // userUrl: `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,\n    const strategy = new OAuth2Strategy(\n      {\n        clientID: clientId,\n        clientSecret: clientSecret,\n        callbackURL: callbackUrl,\n        authorizationURL: authorizationUrl,\n        tokenURL: tokenUrl,\n        passReqToCallback: false,\n      },\n      (\n        accessToken: any,\n        refreshToken: string,\n        params: any,\n        fullProfile: PassportProfile,\n        done: PassportOAuthDoneCallback,\n      ) => {\n        done(undefined, { fullProfile, params, accessToken }, { refreshToken });\n      },\n    );\n\n    strategy.userProfile = function userProfile(\n      accessToken: string,\n      done: (err?: unknown, profile?: any) => void,\n    ): void {\n      this._oauth2.useAuthorizationHeaderforGET(true);\n\n      this._oauth2.get(\n        `${openshiftApiServerUrl}/apis/user.openshift.io/v1/users/~`,\n        accessToken,\n        (error, data, _) => {\n          if (error !== null && error.statusCode !== 200) {\n            done(new Error(`HTTP error! Status: ${error.statusCode}`));\n            return;\n          }\n\n          if (!data) {\n            done(new Error('No data provided!'));\n            return;\n          }\n\n          if (typeof data !== 'string') {\n            done(new Error('Data of type Buffer is not supported!'));\n            return;\n          }\n\n          const user = OpenShiftUser.parse(JSON.parse(data));\n          done(null, { displayName: user.metadata.name });\n        },\n      );\n    };\n\n    return {\n      openshiftApiServerUrl,\n      helper: PassportOAuthAuthenticatorHelper.from(strategy),\n    };\n  },\n  async start(input, { helper }) {\n    return helper.start(input, {\n      accessType: 'offline',\n      prompt: 'consent',\n    });\n  },\n  async authenticate(input, { helper }) {\n    // Same workaround as the GitHub provider; see https://github.com/backstage/backstage/issues/25383\n    const { fullProfile, session } = await helper.authenticate(input);\n    session.refreshToken = session.accessToken;\n    session.refreshTokenExpiresInSeconds = session.expiresInSeconds;\n    return { fullProfile, session };\n  },\n  async refresh(input, { helper }) {\n    // Because the session is refreshed on login, this override is crucial,\n    // see https://github.com/backstage/backstage/issues/25383\n    const accessToken = input.refreshToken;\n\n    const fullProfile = await helper.fetchProfile(accessToken).catch(error => {\n      if (error.oauthError?.statusCode === 401) {\n        throw new Error('Invalid access token');\n      }\n      throw error;\n    });\n\n    return {\n      fullProfile,\n      session: {\n        accessToken,\n        tokenType: 'bearer',\n        scope: input.scope,\n        refreshToken: input.refreshToken,\n      },\n    };\n  },\n  async logout(input, { openshiftApiServerUrl, helper }) {\n    // Due to the implementation of createOAuthRouteHandlers, only the refresh token is set.\n    // In this provider, the refresh token actually IS the access token.\n    const accessToken = input.refreshToken;\n    if (!accessToken) {\n      throw new Error('access token/refresh token needs to be set for logout');\n    }\n\n    // Check if access token is still valid.\n    try {\n      await helper.fetchProfile(accessToken);\n    } catch {\n      // Invalid token, no need to delete OAuthAccessToken.\n      return;\n    }\n\n    // Calculate token name, see:\n    // https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/oauth_apis/oauthaccesstoken-oauth-openshift-io-v1#apis-oauth-openshift-io-v1-oauthaccesstokens\n    const tokenName = createHash('sha256')\n      .update(accessToken.slice('sha256~'.length))\n      .digest()\n      .toString('base64url');\n\n    const response = await fetch(\n      `${openshiftApiServerUrl}/apis/oauth.openshift.io/v1/oauthaccesstokens/sha256~${tokenName}`,\n      { method: 'DELETE', headers: { Authorization: `Bearer ${accessToken}` } },\n    );\n\n    if (response.status === 401) {\n      throw new Error('unauthorized');\n    }\n  },\n});\n"],"names":["z","createOAuthAuthenticator","PassportOAuthAuthenticatorHelper","OAuth2Strategy","createHash"],"mappings":";;;;;;;;;;;AAoCA,MAAM,aAAA,GAAgBA,MAAE,MAAA,CAAO;AAAA,EAC7B,QAAA,EAAUA,MAAE,MAAA,CAAO;AAAA,IACjB,IAAA,EAAMA,MAAE,MAAA;AAAO,GAChB;AACH,CAAC,CAAA;AAGM,MAAM,yBAAyBC,uCAAA,CAGpC;AAAA,EACA,yBACEC,+CAAA,CAAiC,uBAAA;AAAA,EACnC,MAAA,EAAQ;AAAA,IACN,QAAA,EAAU,CAAC,WAAW;AAAA,GACxB;AAAA,EACA,UAAA,CAAW,EAAE,WAAA,EAAa,MAAA,EAAO,EAAG;AAClC,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,MAAA,CAAO,SAAA,CAAU,cAAc,CAAA;AACpD,IAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,SAAA,CAAU,kBAAkB,CAAA;AAC5D,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,CAAU,UAAU,CAAA;AAC5C,IAAA,MAAM,qBAAA,GAAwB,MAAA,CAAO,SAAA,CAAU,uBAAuB,CAAA;AAGtE,IAAA,MAAM,WAAW,IAAIC,+BAAA;AAAA,MACnB;AAAA,QACE,QAAA,EAAU,QAAA;AAAA,QACV,YAAA;AAAA,QACA,WAAA,EAAa,WAAA;AAAA,QACb,gBAAA,EAAkB,gBAAA;AAAA,QAClB,QAAA,EAAU,QAAA;AAAA,QACV,iBAAA,EAAmB;AAAA,OACrB;AAAA,MACA,CACE,WAAA,EACA,YAAA,EACA,MAAA,EACA,aACA,IAAA,KACG;AACH,QAAA,IAAA,CAAK,MAAA,EAAW,EAAE,WAAA,EAAa,MAAA,EAAQ,aAAY,EAAG,EAAE,cAAc,CAAA;AAAA,MACxE;AAAA,KACF;AAEA,IAAA,QAAA,CAAS,WAAA,GAAc,SAAS,WAAA,CAC9B,WAAA,EACA,IAAA,EACM;AACN,MAAA,IAAA,CAAK,OAAA,CAAQ,6BAA6B,IAAI,CAAA;AAE9C,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA;AAAA,QACX,GAAG,qBAAqB,CAAA,kCAAA,CAAA;AAAA,QACxB,WAAA;AAAA,QACA,CAAC,KAAA,EAAO,IAAA,EAAM,CAAA,KAAM;AAClB,UAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,CAAM,UAAA,KAAe,GAAA,EAAK;AAC9C,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAA,CAAM,UAAU,EAAE,CAAC,CAAA;AACzD,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,CAAC,IAAA,EAAM;AACT,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,mBAAmB,CAAC,CAAA;AACnC,YAAA;AAAA,UACF;AAEA,UAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,YAAA,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AACvD,YAAA;AAAA,UACF;AAEA,UAAA,MAAM,OAAO,aAAA,CAAc,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AACjD,UAAA,IAAA,CAAK,MAAM,EAAE,WAAA,EAAa,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA;AAAA,QAChD;AAAA,OACF;AAAA,IACF,CAAA;AAEA,IAAA,OAAO;AAAA,MACL,qBAAA;AAAA,MACA,MAAA,EAAQD,+CAAA,CAAiC,IAAA,CAAK,QAAQ;AAAA,KACxD;AAAA,EACF,CAAA;AAAA,EACA,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,QAAO,EAAG;AAC7B,IAAA,OAAO,MAAA,CAAO,MAAM,KAAA,EAAO;AAAA,MACzB,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA;AAAA,EACA,MAAM,YAAA,CAAa,KAAA,EAAO,EAAE,QAAO,EAAG;AAEpC,IAAA,MAAM,EAAE,WAAA,EAAa,OAAA,KAAY,MAAM,MAAA,CAAO,aAAa,KAAK,CAAA;AAChE,IAAA,OAAA,CAAQ,eAAe,OAAA,CAAQ,WAAA;AAC/B,IAAA,OAAA,CAAQ,+BAA+B,OAAA,CAAQ,gBAAA;AAC/C,IAAA,OAAO,EAAE,aAAa,OAAA,EAAQ;AAAA,EAChC,CAAA;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,EAAE,QAAO,EAAG;AAG/B,IAAA,MAAM,cAAc,KAAA,CAAM,YAAA;AAE1B,IAAA,MAAM,cAAc,MAAM,MAAA,CAAO,aAAa,WAAW,CAAA,CAAE,MAAM,CAAA,KAAA,KAAS;AACxE,MAAA,IAAI,KAAA,CAAM,UAAA,EAAY,UAAA,KAAe,GAAA,EAAK;AACxC,QAAA,MAAM,IAAI,MAAM,sBAAsB,CAAA;AAAA,MACxC;AACA,MAAA,MAAM,KAAA;AAAA,IACR,CAAC,CAAA;AAED,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,OAAA,EAAS;AAAA,QACP,WAAA;AAAA,QACA,SAAA,EAAW,QAAA;AAAA,QACX,OAAO,KAAA,CAAM,KAAA;AAAA,QACb,cAAc,KAAA,CAAM;AAAA;AACtB,KACF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,MAAA,CAAO,KAAA,EAAO,EAAE,qBAAA,EAAuB,QAAO,EAAG;AAGrD,IAAA,MAAM,cAAc,KAAA,CAAM,YAAA;AAC1B,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,IACzE;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,aAAa,WAAW,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAEN,MAAA;AAAA,IACF;AAIA,IAAA,MAAM,SAAA,GAAYE,sBAAA,CAAW,QAAQ,CAAA,CAClC,OAAO,WAAA,CAAY,KAAA,CAAM,SAAA,CAAU,MAAM,CAAC,CAAA,CAC1C,MAAA,EAAO,CACP,SAAS,WAAW,CAAA;AAEvB,IAAA,MAAM,WAAW,MAAM,KAAA;AAAA,MACrB,CAAA,EAAG,qBAAqB,CAAA,qDAAA,EAAwD,SAAS,CAAA,CAAA;AAAA,MACzF,EAAE,QAAQ,QAAA,EAAU,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA,EAAG;AAAE,KAC1E;AAEA,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,IAAI,MAAM,cAAc,CAAA;AAAA,IAChC;AAAA,EACF;AACF,CAAC;;;;"}

package/dist/index.cjs.js

@@ -0,0 +1,12 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var authenticator = require('./authenticator.cjs.js');
+var module$1 = require('./module.cjs.js');
+
+
+
+exports.openshiftAuthenticator = authenticator.openshiftAuthenticator;
+exports.default = module$1.authModuleOpenshiftProvider;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+import * as _backstage_plugin_auth_node from '@backstage/plugin-auth-node';
+import { PassportOAuthAuthenticatorHelper, PassportProfile } from '@backstage/plugin-auth-node';
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+
+/** @public */
+interface OpenShiftAuthenticatorContext {
+    openshiftApiServerUrl: string;
+    helper: PassportOAuthAuthenticatorHelper;
+}
+/** @public */
+declare const openshiftAuthenticator: _backstage_plugin_auth_node.OAuthAuthenticator<OpenShiftAuthenticatorContext, PassportProfile>;
+
+/** @public */
+declare const authModuleOpenshiftProvider: _backstage_backend_plugin_api.BackendFeature;
+
+export { type OpenShiftAuthenticatorContext, authModuleOpenshiftProvider as default, openshiftAuthenticator };

package/dist/module.cjs.js

@@ -0,0 +1,30 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var authenticator = require('./authenticator.cjs.js');
+var resolvers = require('./resolvers.cjs.js');
+
+const authModuleOpenshiftProvider = backendPluginApi.createBackendModule({
+  pluginId: "auth",
+  moduleId: "openshift-provider",
+  register(reg) {
+    reg.registerInit({
+      deps: { providers: pluginAuthNode.authProvidersExtensionPoint },
+      async init({ providers }) {
+        providers.registerProvider({
+          providerId: "openshift",
+          factory: pluginAuthNode.createOAuthProviderFactory({
+            authenticator: authenticator.openshiftAuthenticator,
+            signInResolverFactories: {
+              ...resolvers.openshiftSignInResolvers
+            }
+          })
+        });
+      }
+    });
+  }
+});
+
+exports.authModuleOpenshiftProvider = authModuleOpenshiftProvider;
+//# sourceMappingURL=module.cjs.js.map

package/dist/module.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { createBackendModule } from '@backstage/backend-plugin-api';\nimport {\n  authProvidersExtensionPoint,\n  createOAuthProviderFactory,\n} from '@backstage/plugin-auth-node';\nimport { openshiftAuthenticator } from './authenticator';\nimport { openshiftSignInResolvers } from './resolvers';\n\n/** @public */\nexport const authModuleOpenshiftProvider = createBackendModule({\n  pluginId: 'auth',\n  moduleId: 'openshift-provider',\n  register(reg) {\n    reg.registerInit({\n      deps: { providers: authProvidersExtensionPoint },\n      async init({ providers }) {\n        providers.registerProvider({\n          providerId: 'openshift',\n          factory: createOAuthProviderFactory({\n            authenticator: openshiftAuthenticator,\n            signInResolverFactories: {\n              ...openshiftSignInResolvers,\n            },\n          }),\n        });\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","authProvidersExtensionPoint","createOAuthProviderFactory","openshiftAuthenticator","openshiftSignInResolvers"],"mappings":";;;;;;;AAyBO,MAAM,8BAA8BA,oCAAA,CAAoB;AAAA,EAC7D,QAAA,EAAU,MAAA;AAAA,EACV,QAAA,EAAU,oBAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM,EAAE,SAAA,EAAWC,0CAAA,EAA4B;AAAA,MAC/C,MAAM,IAAA,CAAK,EAAE,SAAA,EAAU,EAAG;AACxB,QAAA,SAAA,CAAU,gBAAA,CAAiB;AAAA,UACzB,UAAA,EAAY,WAAA;AAAA,UACZ,SAASC,yCAAA,CAA2B;AAAA,YAClC,aAAA,EAAeC,oCAAA;AAAA,YACf,uBAAA,EAAyB;AAAA,cACvB,GAAGC;AAAA;AACL,WACD;AAAA,SACF,CAAA;AAAA,MACH;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}

package/dist/resolvers.cjs.js

@@ -0,0 +1,36 @@
+'use strict';
+
+var pluginAuthNode = require('@backstage/plugin-auth-node');
+var catalogModel = require('@backstage/catalog-model');
+var zod = require('zod');
+
+exports.openshiftSignInResolvers = void 0;
+((openshiftSignInResolvers2) => {
+  openshiftSignInResolvers2.displayNameMatchingUserEntityName = pluginAuthNode.createSignInResolverFactory({
+    optionsSchema: zod.z.object({
+      dangerouslyAllowSignInWithoutUserInCatalog: zod.z.boolean().optional()
+    }).optional(),
+    create(options = {}) {
+      return async (info, ctx) => {
+        const { displayName } = info.profile;
+        if (!displayName) {
+          throw new Error(
+            `OpenShift user profile does not contain a displayName`
+          );
+        }
+        const userRef = catalogModel.stringifyEntityRef({
+          kind: "User",
+          name: displayName,
+          namespace: catalogModel.DEFAULT_NAMESPACE
+        });
+        return await ctx.signInWithCatalogUser(
+          { entityRef: userRef },
+          {
+            dangerousEntityRefFallback: options?.dangerouslyAllowSignInWithoutUserInCatalog ? { entityRef: { name: displayName } } : void 0
+          }
+        );
+      };
+    }
+  });
+})(exports.openshiftSignInResolvers || (exports.openshiftSignInResolvers = {}));
+//# sourceMappingURL=resolvers.cjs.js.map

package/dist/resolvers.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolvers.cjs.js","sources":["../src/resolvers.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  createSignInResolverFactory,\n  OAuthAuthenticatorResult,\n  PassportProfile,\n  SignInInfo,\n} from '@backstage/plugin-auth-node';\n\nimport {\n  DEFAULT_NAMESPACE,\n  stringifyEntityRef,\n} from '@backstage/catalog-model';\nimport { z } from 'zod';\n\nexport namespace openshiftSignInResolvers {\n  export const displayNameMatchingUserEntityName = createSignInResolverFactory({\n    optionsSchema: z\n      .object({\n        dangerouslyAllowSignInWithoutUserInCatalog: z.boolean().optional(),\n      })\n      .optional(),\n    create(options = {}) {\n      return async (\n        info: SignInInfo<OAuthAuthenticatorResult<PassportProfile>>,\n        ctx,\n      ) => {\n        const { displayName } = info.profile;\n\n        if (!displayName) {\n          throw new Error(\n            `OpenShift user profile does not contain a displayName`,\n          );\n        }\n\n        const userRef = stringifyEntityRef({\n          kind: 'User',\n          name: displayName,\n          namespace: DEFAULT_NAMESPACE,\n        });\n\n        return await ctx.signInWithCatalogUser(\n          { entityRef: userRef },\n          {\n            dangerousEntityRefFallback:\n              options?.dangerouslyAllowSignInWithoutUserInCatalog\n                ? { entityRef: { name: displayName } }\n                : undefined,\n          },\n        );\n      };\n    },\n  });\n}\n"],"names":["openshiftSignInResolvers","createSignInResolverFactory","z","stringifyEntityRef","DEFAULT_NAMESPACE"],"mappings":";;;;;;AA6BiBA;AAAA,CAAV,CAAUA,yBAAAA,KAAV;AACE,EAAMA,yBAAAA,CAAA,oCAAoCC,0CAAA,CAA4B;AAAA,IAC3E,aAAA,EAAeC,MACZ,MAAA,CAAO;AAAA,MACN,0CAAA,EAA4CA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAClE,EACA,QAAA,EAAS;AAAA,IACZ,MAAA,CAAO,OAAA,GAAU,EAAC,EAAG;AACnB,MAAA,OAAO,OACL,MACA,GAAA,KACG;AACH,QAAA,MAAM,EAAE,WAAA,EAAY,GAAI,IAAA,CAAK,OAAA;AAE7B,QAAA,IAAI,CAAC,WAAA,EAAa;AAChB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,qDAAA;AAAA,WACF;AAAA,QACF;AAEA,QAAA,MAAM,UAAUC,+BAAA,CAAmB;AAAA,UACjC,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,WAAA;AAAA,UACN,SAAA,EAAWC;AAAA,SACZ,CAAA;AAED,QAAA,OAAO,MAAM,GAAA,CAAI,qBAAA;AAAA,UACf,EAAE,WAAW,OAAA,EAAQ;AAAA,UACrB;AAAA,YACE,0BAAA,EACE,SAAS,0CAAA,GACL,EAAE,WAAW,EAAE,IAAA,EAAM,WAAA,EAAY,EAAE,GACnC;AAAA;AACR,SACF;AAAA,MACF,CAAA;AAAA,IACF;AAAA,GACD,CAAA;AAAA,CAAA,EArCcJ,gCAAA,KAAAA,gCAAA,GAAA,EAAA,CAAA,CAAA;;"}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@backstage/plugin-auth-backend-module-openshift-provider",
+  "version": "0.0.0-nightly-20250910023713",
+  "description": "The OpenShift backend module for the auth plugin.",
+  "backstage": {
+    "role": "backend-plugin-module",
+    "pluginId": "auth",
+    "pluginPackage": "@backstage/plugin-auth-backend",
+    "features": {
+      ".": "@backstage/BackendFeature"
+    }
+  },
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/backstage/backstage",
+    "directory": "plugins/auth-backend-module-openshift-provider"
+  },
+  "license": "Apache-2.0",
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "config.d.ts"
+  ],
+  "scripts": {
+    "build": "backstage-cli package build",
+    "clean": "backstage-cli package clean",
+    "lint": "backstage-cli package lint",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack",
+    "start": "backstage-cli package start",
+    "test": "backstage-cli package test"
+  },
+  "dependencies": {
+    "@backstage/backend-plugin-api": "0.0.0-nightly-20250910023713",
+    "@backstage/catalog-model": "1.7.5",
+    "@backstage/plugin-auth-node": "0.0.0-nightly-20250910023713",
+    "@backstage/types": "1.2.1",
+    "passport-oauth2": "^1.8.0",
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "@backstage/backend-defaults": "0.0.0-nightly-20250910023713",
+    "@backstage/backend-test-utils": "0.0.0-nightly-20250910023713",
+    "@backstage/cli": "0.0.0-nightly-20250910023713",
+    "@backstage/config": "1.3.3",
+    "@backstage/plugin-auth-backend": "0.0.0-nightly-20250910023713",
+    "express": "^4.18.2",
+    "msw": "^2.7.3",
+    "supertest": "^7.1.0"
+  },
+  "configSchema": "config.d.ts",
+  "typesVersions": {
+    "*": {
+      "package.json": [
+        "package.json"
+      ]
+    }
+  }
+}