@backstage/plugin-auth-backend 0.15.0-next.2 → 0.15.1-next.0

package/dist/index.cjs.js

@@ -22,7 +22,7 @@ var passportGoogleOauth20 = require('passport-google-oauth20');
 var passportMicrosoft = require('passport-microsoft');
 var pluginAuthNode = require('@backstage/plugin-auth-node');
 var openidClient = require('openid-client');
-var passportOktaOauth = require('passport-okta-oauth');
+var passportOktaOauth = require('@davidzemon/passport-okta-oauth');
 var passportOneloginOauth = require('passport-onelogin-oauth');
 var passportSaml = require('passport-saml');
 var catalogClient = require('@backstage/catalog-client');
@@ -96,10 +96,17 @@ class AtlassianStrategy extends OAuth2Strategy__default["default"] {
   userProfile(accessToken, done) {
     this._oauth2.get(this.profileURL, accessToken, (err, body) => {
       if (err) {
-        return done(new OAuth2Strategy.InternalOAuthError("Failed to fetch user profile", err.statusCode));
+        return done(
+          new OAuth2Strategy.InternalOAuthError(
+            "Failed to fetch user profile",
+            err.statusCode
+          )
+        );
       }
       if (!body) {
-        return done(new Error("Failed to fetch user profile, body cannot be empty"));
+        return done(
+          new Error("Failed to fetch user profile, body cannot be empty")
+        );
       }
       try {
         const json = typeof body !== "string" ? body.toString() : body;
@@ -125,14 +132,18 @@ class AtlassianStrategy extends OAuth2Strategy__default["default"] {
 
 const readState = (stateString) => {
   var _a, _b;
-  const state = Object.fromEntries(new URLSearchParams(Buffer.from(stateString, "hex").toString("utf-8")));
+  const state = Object.fromEntries(
+    new URLSearchParams(Buffer.from(stateString, "hex").toString("utf-8"))
+  );
   if (!state.nonce || !state.env || ((_a = state.nonce) == null ? void 0 : _a.length) === 0 || ((_b = state.env) == null ? void 0 : _b.length) === 0) {
     throw Error(`Invalid state passed via request`);
   }
   return state;
 };
 const encodeState = (state) => {
-  const stateString = new URLSearchParams(pickBy__default["default"](state, (value) => value !== void 0)).toString();
+  const stateString = new URLSearchParams(
+    pickBy__default["default"](state, (value) => value !== void 0)
+  ).toString();
   return Buffer.from(stateString, "utf-8").toString("hex");
 };
 const verifyNonce = (req, providerId) => {
@@ -212,7 +223,9 @@ class OAuthEnvironmentHandler {
     }
     const handler = this.handlers.get(env);
     if (!handler) {
-      throw new errors.NotFoundError(`No configuration available for the '${env}' environment of this provider.`);
+      throw new errors.NotFoundError(
+        `No configuration available for the '${env}' environment of this provider.`
+      );
     }
     return handler;
   }
@@ -340,7 +353,9 @@ class OAuthAdapter {
       state.scope = scope;
     }
     const forwardReq = Object.assign(req, { scope, state });
-    const { url, status } = await this.handlers.start(forwardReq);
+    const { url, status } = await this.handlers.start(
+      forwardReq
+    );
     res.statusCode = status || 302;
     res.setHeader("Location", url);
     res.setHeader("Content-Length", "0");
@@ -396,7 +411,9 @@ class OAuthAdapter {
       throw new errors.AuthenticationError("Invalid X-Requested-With header");
     }
     if (!this.handlers.refresh) {
-      throw new errors.InputError(`Refresh token is not supported for provider ${this.options.providerId}`);
+      throw new errors.InputError(
+        `Refresh token is not supported for provider ${this.options.providerId}`
+      );
     }
     try {
       const refreshToken = req.cookies[`${this.options.providerId}-refresh-token`];
@@ -409,7 +426,9 @@ class OAuthAdapter {
       }
       const forwardReq = Object.assign(req, { scope, refreshToken });
       const { response, refreshToken: newRefreshToken } = await this.handlers.refresh(forwardReq);
-      const backstageIdentity = await this.populateIdentity(response.backstageIdentity);
+      const backstageIdentity = await this.populateIdentity(
+        response.backstageIdentity
+      );
       if (newRefreshToken && newRefreshToken !== refreshToken) {
         this.setRefreshTokenCookie(res, newRefreshToken);
       }
@@ -476,69 +495,89 @@ const executeRedirectStrategy = async (req, providerStrategy, options) => {
   });
 };
 const executeFrameHandlerStrategy = async (req, providerStrategy) => {
-  return new Promise((resolve, reject) => {
-    const strategy = Object.create(providerStrategy);
-    strategy.success = (result, privateInfo) => {
-      resolve({ result, privateInfo });
-    };
-    strategy.fail = (info) => {
-      var _a;
-      reject(new Error(`Authentication rejected, ${(_a = info.message) != null ? _a : ""}`));
-    };
-    strategy.error = (error) => {
-      var _a;
-      let message = `Authentication failed, ${error.message}`;
-      if ((_a = error.oauthError) == null ? void 0 : _a.data) {
-        try {
-          const errorData = JSON.parse(error.oauthError.data);
-          if (errorData.message) {
-            message += ` - ${errorData.message}`;
+  return new Promise(
+    (resolve, reject) => {
+      const strategy = Object.create(providerStrategy);
+      strategy.success = (result, privateInfo) => {
+        resolve({ result, privateInfo });
+      };
+      strategy.fail = (info) => {
+        var _a;
+        reject(new Error(`Authentication rejected, ${(_a = info.message) != null ? _a : ""}`));
+      };
+      strategy.error = (error) => {
+        var _a;
+        let message = `Authentication failed, ${error.message}`;
+        if ((_a = error.oauthError) == null ? void 0 : _a.data) {
+          try {
+            const errorData = JSON.parse(error.oauthError.data);
+            if (errorData.message) {
+              message += ` - ${errorData.message}`;
+            }
+          } catch (parseError) {
+            message += ` - ${error.oauthError}`;
           }
-        } catch (parseError) {
-          message += ` - ${error.oauthError}`;
         }
-      }
-      reject(new Error(message));
-    };
-    strategy.redirect = () => {
-      reject(new Error("Unexpected redirect"));
-    };
-    strategy.authenticate(req, {});
-  });
+        reject(new Error(message));
+      };
+      strategy.redirect = () => {
+        reject(new Error("Unexpected redirect"));
+      };
+      strategy.authenticate(req, {});
+    }
+  );
 };
 const executeRefreshTokenStrategy = async (providerStrategy, refreshToken, scope) => {
   return new Promise((resolve, reject) => {
     const anyStrategy = providerStrategy;
     const OAuth2 = anyStrategy._oauth2.constructor;
-    const oauth2 = new OAuth2(anyStrategy._oauth2._clientId, anyStrategy._oauth2._clientSecret, anyStrategy._oauth2._baseSite, anyStrategy._oauth2._authorizeUrl, anyStrategy._refreshURL || anyStrategy._oauth2._accessTokenUrl, anyStrategy._oauth2._customHeaders);
-    oauth2.getOAuthAccessToken(refreshToken, {
-      scope,
-      grant_type: "refresh_token"
-    }, (err, accessToken, newRefreshToken, params) => {
-      if (err) {
-        reject(new Error(`Failed to refresh access token ${err.toString()}`));
-      }
-      if (!accessToken) {
-        reject(new Error(`Failed to refresh access token, no access token received`));
+    const oauth2 = new OAuth2(
+      anyStrategy._oauth2._clientId,
+      anyStrategy._oauth2._clientSecret,
+      anyStrategy._oauth2._baseSite,
+      anyStrategy._oauth2._authorizeUrl,
+      anyStrategy._refreshURL || anyStrategy._oauth2._accessTokenUrl,
+      anyStrategy._oauth2._customHeaders
+    );
+    oauth2.getOAuthAccessToken(
+      refreshToken,
+      {
+        scope,
+        grant_type: "refresh_token"
+      },
+      (err, accessToken, newRefreshToken, params) => {
+        if (err) {
+          reject(new Error(`Failed to refresh access token ${err.toString()}`));
+        }
+        if (!accessToken) {
+          reject(
+            new Error(
+              `Failed to refresh access token, no access token received`
+            )
+          );
+        }
+        resolve({
+          accessToken,
+          refreshToken: newRefreshToken,
+          params
+        });
       }
-      resolve({
-        accessToken,
-        refreshToken: newRefreshToken,
-        params
-      });
-    });
+    );
   });
 };
 const executeFetchUserProfileStrategy = async (providerStrategy, accessToken) => {
   return new Promise((resolve, reject) => {
     const anyStrategy = providerStrategy;
-    anyStrategy.userProfile(accessToken, (error, rawProfile) => {
-      if (error) {
-        reject(error);
-      } else {
-        resolve(rawProfile);
+    anyStrategy.userProfile(
+      accessToken,
+      (error, rawProfile) => {
+        if (error) {
+          reject(error);
+        } else {
+          resolve(rawProfile);
+        }
       }
-    });
+    );
   });
 };
 
@@ -561,19 +600,22 @@ class AtlassianAuthProvider {
     this.resolverContext = options.resolverContext;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
-    this._strategy = new AtlassianStrategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      scope: options.scopes
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        fullProfile,
-        accessToken,
-        refreshToken,
-        params
-      });
-    });
+    this._strategy = new AtlassianStrategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        scope: options.scopes
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, {
+          fullProfile,
+          accessToken,
+          refreshToken,
+          params
+        });
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -581,7 +623,10 @@ class AtlassianAuthProvider {
     });
   }
   async handler(req) {
-    const { result } = await executeFrameHandlerStrategy(req, this._strategy);
+    const { result } = await executeFrameHandlerStrategy(
+      req,
+      this._strategy
+    );
     return {
       response: await this.handleResult(result),
       refreshToken: result.refreshToken
@@ -599,16 +644,26 @@ class AtlassianAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
   async refresh(req) {
-    const { accessToken, params, refreshToken } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { accessToken, params, refreshToken } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -664,22 +719,29 @@ class Auth0AuthProvider {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
-    this._strategy = new Auth0Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      domain: options.domain,
-      passReqToCallback: false
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        fullProfile,
-        accessToken,
-        refreshToken,
-        params
-      }, {
-        refreshToken
-      });
-    });
+    this._strategy = new Auth0Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        domain: options.domain,
+        passReqToCallback: false
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          {
+            fullProfile,
+            accessToken,
+            refreshToken,
+            params
+          },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -697,8 +759,15 @@ class Auth0AuthProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -720,10 +789,13 @@ class Auth0AuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -770,9 +842,16 @@ class AwsAlbAuthProvider {
       if (optionalCacheKey) {
         return crypto__namespace.createPublicKey(optionalCacheKey);
       }
-      const keyText = await fetch__default["default"](`https://public-keys.auth.elb.${encodeURIComponent(this.region)}.amazonaws.com/${encodeURIComponent(header.kid)}`).then((response) => response.text());
+      const keyText = await fetch__default["default"](
+        `https://public-keys.auth.elb.${encodeURIComponent(
+          this.region
+        )}.amazonaws.com/${encodeURIComponent(header.kid)}`
+      ).then((response) => response.text());
       const keyValue = crypto__namespace.createPublicKey(keyText);
-      this.keyCache.set(header.kid, keyValue.export({ format: "pem", type: "spki" }));
+      this.keyCache.set(
+        header.kid,
+        keyValue.export({ format: "pem", type: "spki" })
+      );
       return keyValue;
     };
     this.region = options.region;
@@ -791,7 +870,10 @@ class AwsAlbAuthProvider {
       const response = await this.handleResult(result);
       res.json(response);
     } catch (e) {
-      throw new errors.AuthenticationError("Exception occurred during AWS ALB token refresh", e);
+      throw new errors.AuthenticationError(
+        "Exception occurred during AWS ALB token refresh",
+        e
+      );
     }
   }
   start() {
@@ -801,10 +883,14 @@ class AwsAlbAuthProvider {
     const jwt = req.header(ALB_JWT_HEADER);
     const accessToken = req.header(ALB_ACCESS_TOKEN_HEADER);
     if (jwt === void 0) {
-      throw new errors.AuthenticationError(`Missing ALB OIDC header: ${ALB_JWT_HEADER}`);
+      throw new errors.AuthenticationError(
+        `Missing ALB OIDC header: ${ALB_JWT_HEADER}`
+      );
     }
     if (accessToken === void 0) {
-      throw new errors.AuthenticationError(`Missing ALB OIDC header: ${ALB_ACCESS_TOKEN_HEADER}`);
+      throw new errors.AuthenticationError(
+        `Missing ALB OIDC header: ${ALB_ACCESS_TOKEN_HEADER}`
+      );
     }
     try {
       const verifyResult = await jose.jwtVerify(jwt, this.getKey);
@@ -835,10 +921,13 @@ class AwsAlbAuthProvider {
   }
   async handleResult(result) {
     const { profile } = await this.authHandler(result, this.resolverContext);
-    const backstageIdentity = await this.signInResolver({
-      result,
-      profile
-    }, this.resolverContext);
+    const backstageIdentity = await this.signInResolver(
+      {
+        result,
+        profile
+      },
+      this.resolverContext
+    );
     return {
       providerInfo: {
         accessToken: result.accessToken,
@@ -855,7 +944,9 @@ const awsAlb = createAuthProviderIntegration({
       const region = config.getString("region");
       const issuer = config.getOptionalString("iss");
       if ((options == null ? void 0 : options.signIn.resolver) === void 0) {
-        throw new Error("SignInResolver is required to use this authentication provider");
+        throw new Error(
+          "SignInResolver is required to use this authentication provider"
+        );
       }
       const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ fullProfile }) => ({
         profile: makeProfileInfo(fullProfile)
@@ -876,21 +967,28 @@ class BitbucketAuthProvider {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
-    this._strategy = new passportBitbucketOauth2.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      passReqToCallback: false
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        fullProfile,
-        params,
-        accessToken,
-        refreshToken
-      }, {
-        refreshToken
-      });
-    });
+    this._strategy = new passportBitbucketOauth2.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        passReqToCallback: false
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          {
+            fullProfile,
+            params,
+            accessToken,
+            refreshToken
+          },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -908,8 +1006,15 @@ class BitbucketAuthProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -932,10 +1037,13 @@ class BitbucketAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -995,13 +1103,172 @@ const bitbucket = createAuthProviderIntegration({
   }
 });
 
+const commonByEmailLocalPartResolver = async (info, ctx) => {
+  const { profile } = info;
+  if (!profile.email) {
+    throw new Error("Login failed, user profile does not contain an email");
+  }
+  const [localPart] = profile.email.split("@");
+  return ctx.signInWithCatalogUser({
+    entityRef: { name: localPart }
+  });
+};
+const commonByEmailResolver = async (info, ctx) => {
+  const { profile } = info;
+  if (!profile.email) {
+    throw new Error("Login failed, user profile does not contain an email");
+  }
+  return ctx.signInWithCatalogUser({
+    filter: {
+      "spec.profile.email": profile.email
+    }
+  });
+};
+
+const CF_JWT_HEADER = "cf-access-jwt-assertion";
+const COOKIE_AUTH_NAME = "CF_Authorization";
+const CACHE_PREFIX = "providers/cloudflare-access/profile-v1";
+class CloudflareAccessAuthProvider {
+  constructor(options) {
+    this.teamName = options.teamName;
+    this.authHandler = options.authHandler;
+    this.signInResolver = options.signInResolver;
+    this.resolverContext = options.resolverContext;
+    this.jwtKeySet = jose.createRemoteJWKSet(
+      new URL(
+        `https://${this.teamName}.cloudflareaccess.com/cdn-cgi/access/certs`
+      )
+    );
+    this.cache = options.cache;
+  }
+  frameHandler() {
+    return Promise.resolve();
+  }
+  async refresh(req, res) {
+    const result = await this.getResult(req);
+    const response = await this.handleResult(result);
+    res.json(response);
+  }
+  start() {
+    return Promise.resolve();
+  }
+  async getIdentityProfile(jwt) {
+    const headers = new fetch.Headers();
+    headers.set(CF_JWT_HEADER, jwt);
+    headers.set("cookie", `${COOKIE_AUTH_NAME}=${jwt}`);
+    try {
+      const res = await fetch__default["default"](
+        `https://${this.teamName}.cloudflareaccess.com/cdn-cgi/access/get-identity`,
+        { headers }
+      );
+      if (!res.ok) {
+        throw errors.ResponseError.fromResponse(res);
+      }
+      const cfIdentity = await res.json();
+      return cfIdentity;
+    } catch (err) {
+      throw new errors.ForwardedError("getIdentityProfile failed", err);
+    }
+  }
+  async getResult(req) {
+    var _a, _b;
+    let jwt = req.header(CF_JWT_HEADER);
+    if (!jwt) {
+      jwt = req.cookies.CF_Authorization;
+    }
+    if (!jwt) {
+      throw new errors.AuthenticationError(
+        `Missing ${CF_JWT_HEADER} from Cloudflare Access`
+      );
+    }
+    const verifyResult = await jose.jwtVerify(jwt, this.jwtKeySet, {
+      issuer: `https://${this.teamName}.cloudflareaccess.com`
+    });
+    const sub = verifyResult.payload.sub;
+    const cfAccessResultStr = await ((_a = this.cache) == null ? void 0 : _a.get(`${CACHE_PREFIX}/${sub}`));
+    if (typeof cfAccessResultStr === "string") {
+      return JSON.parse(cfAccessResultStr);
+    }
+    const claims = verifyResult.payload;
+    try {
+      const cfIdentity = await this.getIdentityProfile(jwt);
+      const cfAccessResult = {
+        claims,
+        cfIdentity,
+        expiresInSeconds: claims.exp - claims.iat
+      };
+      (_b = this.cache) == null ? void 0 : _b.set(`${CACHE_PREFIX}/${sub}`, JSON.stringify(cfAccessResult));
+      return cfAccessResult;
+    } catch (err) {
+      throw new errors.ForwardedError(
+        "Failed to populate access identity information",
+        err
+      );
+    }
+  }
+  async handleResult(result) {
+    const { profile } = await this.authHandler(result, this.resolverContext);
+    const backstageIdentity = await this.signInResolver(
+      {
+        result,
+        profile
+      },
+      this.resolverContext
+    );
+    return {
+      providerInfo: {
+        expiresInSeconds: result.expiresInSeconds,
+        claims: result.claims,
+        cfAccessIdentityProfile: result.cfIdentity
+      },
+      backstageIdentity: prepareBackstageIdentityResponse(backstageIdentity),
+      profile
+    };
+  }
+}
+const cfAccess = createAuthProviderIntegration({
+  create(options) {
+    return ({ config, resolverContext }) => {
+      const teamName = config.getString("teamName");
+      if (!options.signIn.resolver) {
+        throw new Error(
+          "SignInResolver is required to use this authentication provider"
+        );
+      }
+      const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ claims, cfIdentity }) => {
+        return {
+          profile: {
+            email: claims.email,
+            displayName: cfIdentity.name
+          }
+        };
+      };
+      return new CloudflareAccessAuthProvider({
+        teamName,
+        signInResolver: options == null ? void 0 : options.signIn.resolver,
+        authHandler,
+        resolverContext,
+        ...options.cache && { cache: options.cache }
+      });
+    };
+  },
+  resolvers: {
+    emailMatchingUserEntityProfileEmail: () => commonByEmailResolver
+  }
+});
+
 const IAP_JWT_HEADER = "x-goog-iap-jwt-assertion";
 
 function createTokenValidator(audience, mockClient) {
   const client = mockClient != null ? mockClient : new googleAuthLibrary.OAuth2Client();
   return async function tokenValidator(token) {
     const response = await client.getIapPublicKeys();
-    const ticket = await client.verifySignedJwtWithCertsAsync(token, response.pubkeys, audience, ["https://cloud.google.com/iap"]);
+    const ticket = await client.verifySignedJwtWithCertsAsync(
+      token,
+      response.pubkeys,
+      audience,
+      ["https://cloud.google.com/iap"]
+    );
     const payload = ticket.getPayload();
     if (!payload) {
       throw new TypeError("Token had no payload");
@@ -1011,7 +1278,9 @@ function createTokenValidator(audience, mockClient) {
 }
 async function parseRequestToken(jwtToken, tokenValidator) {
   if (typeof jwtToken !== "string" || !jwtToken) {
-    throw new errors.AuthenticationError(`Missing Google IAP header: ${IAP_JWT_HEADER}`);
+    throw new errors.AuthenticationError(
+      `Missing Google IAP header: ${IAP_JWT_HEADER}`
+    );
   }
   let payload;
   try {
@@ -1020,7 +1289,9 @@ async function parseRequestToken(jwtToken, tokenValidator) {
     throw new errors.AuthenticationError(`Google IAP token verification failed, ${e}`);
   }
   if (!payload.sub || !payload.email) {
-    throw new errors.AuthenticationError("Google IAP token payload is missing sub and/or email claim");
+    throw new errors.AuthenticationError(
+      "Google IAP token payload is missing sub and/or email claim"
+    );
   }
   return {
     iapToken: {
@@ -1046,9 +1317,15 @@ class GcpIapProvider {
   async frameHandler() {
   }
   async refresh(req, res) {
-    const result = await parseRequestToken(req.header(IAP_JWT_HEADER), this.tokenValidator);
+    const result = await parseRequestToken(
+      req.header(IAP_JWT_HEADER),
+      this.tokenValidator
+    );
     const { profile } = await this.authHandler(result, this.resolverContext);
-    const backstageIdentity = await this.signInResolver({ profile, result }, this.resolverContext);
+    const backstageIdentity = await this.signInResolver(
+      { profile, result },
+      this.resolverContext
+    );
     const response = {
       providerInfo: { iapToken: result.iapToken },
       profile,
@@ -1083,16 +1360,19 @@ class GithubAuthProvider {
     this.authHandler = options.authHandler;
     this.stateEncoder = options.stateEncoder;
     this.resolverContext = options.resolverContext;
-    this._strategy = new passportGithub2.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      tokenURL: options.tokenUrl,
-      userProfileURL: options.userProfileUrl,
-      authorizationURL: options.authorizationUrl
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, { fullProfile, params, accessToken }, { refreshToken });
-    });
+    this._strategy = new passportGithub2.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        tokenURL: options.tokenUrl,
+        userProfileURL: options.userProfileUrl,
+        authorizationURL: options.authorizationUrl
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, { fullProfile, params, accessToken }, { refreshToken });
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -1115,7 +1395,10 @@ class GithubAuthProvider {
     const { scope, refreshToken } = req;
     if (refreshToken == null ? void 0 : refreshToken.startsWith(ACCESS_TOKEN_PREFIX)) {
       const accessToken = refreshToken.slice(ACCESS_TOKEN_PREFIX.length);
-      const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken).catch((error) => {
+      const fullProfile = await executeFetchUserProfileStrategy(
+        this._strategy,
+        accessToken
+      ).catch((error) => {
         var _a;
         if (((_a = error.oauthError) == null ? void 0 : _a.statusCode) === 401) {
           throw new Error("Invalid access token");
@@ -1131,10 +1414,17 @@ class GithubAuthProvider {
         refreshToken
       };
     }
-    const result = await executeRefreshTokenStrategy(this._strategy, refreshToken, scope);
+    const result = await executeRefreshTokenStrategy(
+      this._strategy,
+      refreshToken,
+      scope
+    );
     return {
       response: await this.handleResult({
-        fullProfile: await executeFetchUserProfileStrategy(this._strategy, result.accessToken),
+        fullProfile: await executeFetchUserProfileStrategy(
+          this._strategy,
+          result.accessToken
+        ),
         params: { ...result.params, scope },
         accessToken: result.accessToken
       }),
@@ -1147,12 +1437,18 @@ class GithubAuthProvider {
     let expiresInSeconds = expiresInStr === void 0 ? void 0 : Number(expiresInStr);
     let backstageIdentity = void 0;
     if (this.signInResolver) {
-      backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
       if (expiresInSeconds) {
-        expiresInSeconds = Math.min(expiresInSeconds, BACKSTAGE_SESSION_EXPIRATION);
+        expiresInSeconds = Math.min(
+          expiresInSeconds,
+          BACKSTAGE_SESSION_EXPIRATION
+        );
       } else {
         expiresInSeconds = BACKSTAGE_SESSION_EXPIRATION;
       }
@@ -1230,16 +1526,23 @@ class GitlabAuthProvider {
     this.resolverContext = options.resolverContext;
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
-    this._strategy = new passportGitlab2.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      baseURL: options.baseUrl
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, { fullProfile, params, accessToken }, {
-        refreshToken
-      });
-    });
+    this._strategy = new passportGitlab2.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        baseURL: options.baseUrl
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          { fullProfile, params, accessToken },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -1255,8 +1558,15 @@ class GitlabAuthProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -1278,10 +1588,13 @@ class GitlabAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -1314,48 +1627,33 @@ const gitlab = createAuthProviderIntegration({
   }
 });
 
-const commonByEmailLocalPartResolver = async (info, ctx) => {
-  const { profile } = info;
-  if (!profile.email) {
-    throw new Error("Login failed, user profile does not contain an email");
-  }
-  const [localPart] = profile.email.split("@");
-  return ctx.signInWithCatalogUser({
-    entityRef: { name: localPart }
-  });
-};
-const commonByEmailResolver = async (info, ctx) => {
-  const { profile } = info;
-  if (!profile.email) {
-    throw new Error("Login failed, user profile does not contain an email");
-  }
-  return ctx.signInWithCatalogUser({
-    filter: {
-      "spec.profile.email": profile.email
-    }
-  });
-};
-
 class GoogleAuthProvider {
   constructor(options) {
     this.authHandler = options.authHandler;
     this.signInResolver = options.signInResolver;
     this.resolverContext = options.resolverContext;
-    this.strategy = new passportGoogleOauth20.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      passReqToCallback: false
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        fullProfile,
-        params,
-        accessToken,
-        refreshToken
-      }, {
-        refreshToken
-      });
-    });
+    this.strategy = new passportGoogleOauth20.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        passReqToCallback: false
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          {
+            fullProfile,
+            params,
+            accessToken,
+            refreshToken
+          },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this.strategy, {
@@ -1373,8 +1671,15 @@ class GoogleAuthProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this.strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this.strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this.strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this.strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -1396,10 +1701,13 @@ class GoogleAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -1454,16 +1762,19 @@ class MicrosoftAuthProvider {
     this.authHandler = options.authHandler;
     this.logger = options.logger;
     this.resolverContext = options.resolverContext;
-    this._strategy = new passportMicrosoft.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      authorizationURL: options.authorizationUrl,
-      tokenURL: options.tokenUrl,
-      passReqToCallback: false
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, { fullProfile, accessToken, params }, { refreshToken });
-    });
+    this._strategy = new passportMicrosoft.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        authorizationURL: options.authorizationUrl,
+        tokenURL: options.tokenUrl,
+        passReqToCallback: false
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(void 0, { fullProfile, accessToken, params }, { refreshToken });
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -1479,8 +1790,15 @@ class MicrosoftAuthProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -1504,24 +1822,32 @@ class MicrosoftAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
   async getUserPhoto(accessToken) {
     try {
-      const res = await fetch__default["default"]("https://graph.microsoft.com/v1.0/me/photos/48x48/$value", {
-        headers: {
-          Authorization: `Bearer ${accessToken}`
+      const res = await fetch__default["default"](
+        "https://graph.microsoft.com/v1.0/me/photos/48x48/$value",
+        {
+          headers: {
+            Authorization: `Bearer ${accessToken}`
+          }
         }
-      });
+      );
       const data = await res.buffer();
       return `data:image/jpeg;base64,${data.toString("base64")}`;
     } catch (error) {
-      this.logger.warn(`Could not retrieve user profile photo from Microsoft Graph API: ${error}`);
+      this.logger.warn(
+        `Could not retrieve user profile photo from Microsoft Graph API: ${error}`
+      );
       return void 0;
     }
   }
@@ -1583,27 +1909,37 @@ class OAuth2AuthProvider {
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
     this.disableRefresh = (_a = options.disableRefresh) != null ? _a : false;
-    this._strategy = new OAuth2Strategy.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      authorizationURL: options.authorizationUrl,
-      tokenURL: options.tokenUrl,
-      passReqToCallback: false,
-      scope: options.scope,
-      customHeaders: options.includeBasicAuth ? {
-        Authorization: `Basic ${this.encodeClientCredentials(options.clientId, options.clientSecret)}`
-      } : void 0
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        fullProfile,
-        accessToken,
-        refreshToken,
-        params
-      }, {
-        refreshToken
-      });
-    });
+    this._strategy = new OAuth2Strategy.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        authorizationURL: options.authorizationUrl,
+        tokenURL: options.tokenUrl,
+        passReqToCallback: false,
+        scope: options.scope,
+        customHeaders: options.includeBasicAuth ? {
+          Authorization: `Basic ${this.encodeClientCredentials(
+            options.clientId,
+            options.clientSecret
+          )}`
+        } : void 0
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          {
+            fullProfile,
+            accessToken,
+            refreshToken,
+            params
+          },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -1624,9 +1960,16 @@ class OAuth2AuthProvider {
     if (this.disableRefresh) {
       throw new errors.InputError("Session refreshes have been disabled");
     }
-    const refreshTokenResponse = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
+    const refreshTokenResponse = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
     const { accessToken, params, refreshToken } = refreshTokenResponse;
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -1648,10 +1991,13 @@ class OAuth2AuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -1733,15 +2079,20 @@ class Oauth2ProxyAuthProvider {
   }
   async handleResult(result) {
     const { profile } = await this.authHandler(result, this.resolverContext);
-    const backstageSignInResult = await this.signInResolver({
-      result,
-      profile
-    }, this.resolverContext);
+    const backstageSignInResult = await this.signInResolver(
+      {
+        result,
+        profile
+      },
+      this.resolverContext
+    );
     return {
       providerInfo: {
         accessToken: result.accessToken
       },
-      backstageIdentity: prepareBackstageIdentityResponse(backstageSignInResult),
+      backstageIdentity: prepareBackstageIdentityResponse(
+        backstageSignInResult
+      ),
       profile
     };
   }
@@ -1820,17 +2171,26 @@ class OidcAuthProvider {
       id_token_signed_response_alg: options.tokenSignedResponseAlg || "RS256",
       scope: options.scope || ""
     });
-    const strategy = new openidClient.Strategy({
-      client,
-      passReqToCallback: false
-    }, (tokenset, userinfo, done) => {
-      if (typeof done !== "function") {
-        throw new Error("OIDC IdP must provide a userinfo_endpoint in the metadata response");
+    const strategy = new openidClient.Strategy(
+      {
+        client,
+        passReqToCallback: false
+      },
+      (tokenset, userinfo, done) => {
+        if (typeof done !== "function") {
+          throw new Error(
+            "OIDC IdP must provide a userinfo_endpoint in the metadata response"
+          );
+        }
+        done(
+          void 0,
+          { tokenset, userinfo },
+          {
+            refreshToken: tokenset.refresh_token
+          }
+        );
       }
-      done(void 0, { tokenset, userinfo }, {
-        refreshToken: tokenset.refresh_token
-      });
-    });
+    );
     strategy.error = console.error;
     return { strategy, client };
   }
@@ -1846,10 +2206,13 @@ class OidcAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -1863,7 +2226,9 @@ const oidc = createAuthProviderIntegration({
       const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       const metadataUrl = envConfig.getString("metadataUrl");
-      const tokenSignedResponseAlg = envConfig.getOptionalString("tokenSignedResponseAlg");
+      const tokenSignedResponseAlg = envConfig.getOptionalString(
+        "tokenSignedResponseAlg"
+      );
       const scope = envConfig.getOptionalString("scope");
       const prompt = envConfig.getOptionalString("prompt");
       const authHandler = (options == null ? void 0 : options.authHandler) ? options.authHandler : async ({ userinfo }) => ({
@@ -1906,24 +2271,33 @@ class OktaAuthProvider {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
-    this.strategy = new passportOktaOauth.Strategy({
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      audience: options.audience,
-      passReqToCallback: false,
-      store: this.store,
-      response_type: "code"
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        accessToken,
-        refreshToken,
-        params,
-        fullProfile
-      }, {
-        refreshToken
-      });
-    });
+    this.strategy = new passportOktaOauth.Strategy(
+      {
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        audience: options.audience,
+        authServerID: options.authServerId,
+        idp: options.idp,
+        passReqToCallback: false,
+        store: this.store,
+        response_type: "code"
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          {
+            accessToken,
+            refreshToken,
+            params,
+            fullProfile
+          },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this.strategy, {
@@ -1941,8 +2315,15 @@ class OktaAuthProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this.strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this.strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this.strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this.strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -1964,10 +2345,13 @@ class OktaAuthProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -1979,6 +2363,8 @@ const okta = createAuthProviderIntegration({
       const clientId = envConfig.getString("clientId");
       const clientSecret = envConfig.getString("clientSecret");
       const audience = envConfig.getString("audience");
+      const authServerId = envConfig.getOptionalString("authServerId");
+      const idp = envConfig.getOptionalString("idp");
       const customCallbackUrl = envConfig.getOptionalString("callbackUrl");
       const callbackUrl = customCallbackUrl || `${globalConfig.baseUrl}/${providerId}/handler/frame`;
       if (!audience.startsWith("https://")) {
@@ -1989,6 +2375,8 @@ const okta = createAuthProviderIntegration({
       });
       const provider = new OktaAuthProvider({
         audience,
+        authServerId,
+        idp,
         clientId,
         clientSecret,
         callbackUrl,
@@ -2026,22 +2414,29 @@ class OneLoginProvider {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
-    this._strategy = new passportOneloginOauth.Strategy({
-      issuer: options.issuer,
-      clientID: options.clientId,
-      clientSecret: options.clientSecret,
-      callbackURL: options.callbackUrl,
-      passReqToCallback: false
-    }, (accessToken, refreshToken, params, fullProfile, done) => {
-      done(void 0, {
-        accessToken,
-        refreshToken,
-        params,
-        fullProfile
-      }, {
-        refreshToken
-      });
-    });
+    this._strategy = new passportOneloginOauth.Strategy(
+      {
+        issuer: options.issuer,
+        clientID: options.clientId,
+        clientSecret: options.clientSecret,
+        callbackURL: options.callbackUrl,
+        passReqToCallback: false
+      },
+      (accessToken, refreshToken, params, fullProfile, done) => {
+        done(
+          void 0,
+          {
+            accessToken,
+            refreshToken,
+            params,
+            fullProfile
+          },
+          {
+            refreshToken
+          }
+        );
+      }
+    );
   }
   async start(req) {
     return await executeRedirectStrategy(req, this._strategy, {
@@ -2059,8 +2454,15 @@ class OneLoginProvider {
     };
   }
   async refresh(req) {
-    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(this._strategy, req.refreshToken, req.scope);
-    const fullProfile = await executeFetchUserProfileStrategy(this._strategy, accessToken);
+    const { accessToken, refreshToken, params } = await executeRefreshTokenStrategy(
+      this._strategy,
+      req.refreshToken,
+      req.scope
+    );
+    const fullProfile = await executeFetchUserProfileStrategy(
+      this._strategy,
+      accessToken
+    );
     return {
       response: await this.handleResult({
         fullProfile,
@@ -2082,10 +2484,13 @@ class OneLoginProvider {
       profile
     };
     if (this.signInResolver) {
-      response.backstageIdentity = await this.signInResolver({
-        result,
-        profile
-      }, this.resolverContext);
+      response.backstageIdentity = await this.signInResolver(
+        {
+          result,
+          profile
+        },
+        this.resolverContext
+      );
     }
     return response;
   }
@@ -2135,17 +2540,23 @@ class SamlAuthProvider {
   }
   async frameHandler(req, res) {
     try {
-      const { result } = await executeFrameHandlerStrategy(req, this.strategy);
+      const { result } = await executeFrameHandlerStrategy(
+        req,
+        this.strategy
+      );
       const { profile } = await this.authHandler(result, this.resolverContext);
       const response = {
         profile,
         providerInfo: {}
       };
       if (this.signInResolver) {
-        const signInResponse = await this.signInResolver({
-          result,
-          profile
-        }, this.resolverContext);
+        const signInResponse = await this.signInResolver(
+          {
+            result,
+            profile
+          },
+          this.resolverContext
+        );
         response.backstageIdentity = prepareBackstageIdentityResponse(signInResponse);
       }
       return postMessageResponse(res, this.appUrl, {
@@ -2215,6 +2626,7 @@ const providers = Object.freeze({
   auth0,
   awsAlb,
   bitbucket,
+  cfAccess,
   gcpIap,
   github,
   gitlab,
@@ -2296,7 +2708,9 @@ class TokenFactory {
     try {
       catalogModel.parseEntityRef(sub);
     } catch (error) {
-      throw new Error('"sub" claim provided by the auth resolver is not a valid EntityRef.');
+      throw new Error(
+        '"sub" claim provided by the auth resolver is not a valid EntityRef.'
+      );
     }
     this.logger.info(`Issuing token for ${sub}, with entities ${ent != null ? ent : []}`);
     if (!key.alg) {
@@ -2360,12 +2774,17 @@ class TokenFactory {
   }
 }
 
-const migrationsDir = backendCommon.resolvePackagePath("@backstage/plugin-auth-backend", "migrations");
+const migrationsDir = backendCommon.resolvePackagePath(
+  "@backstage/plugin-auth-backend",
+  "migrations"
+);
 const TABLE = "signing_keys";
 const parseDate = (date) => {
   const parsedDate = typeof date === "string" ? luxon.DateTime.fromSQL(date, { zone: "UTC" }) : luxon.DateTime.fromJSDate(date);
   if (!parsedDate.isValid) {
-    throw new Error(`Failed to parse date, reason: ${parsedDate.invalidReason}, explanation: ${parsedDate.invalidExplanation}`);
+    throw new Error(
+      `Failed to parse date, reason: ${parsedDate.invalidReason}, explanation: ${parsedDate.invalidExplanation}`
+    );
   }
   return parsedDate.toJSDate();
 };
@@ -2436,26 +2855,38 @@ class FirestoreKeyStore {
   static async create(settings) {
     const { path, timeout, ...firestoreSettings } = settings != null ? settings : {};
     const database = new firestore.Firestore(firestoreSettings);
-    return new FirestoreKeyStore(database, path != null ? path : DEFAULT_DOCUMENT_PATH, timeout != null ? timeout : DEFAULT_TIMEOUT_MS);
+    return new FirestoreKeyStore(
+      database,
+      path != null ? path : DEFAULT_DOCUMENT_PATH,
+      timeout != null ? timeout : DEFAULT_TIMEOUT_MS
+    );
   }
   static async verifyConnection(keyStore, logger) {
     try {
       await keyStore.verify();
     } catch (error) {
       if (process.env.NODE_ENV !== "development") {
-        throw new Error(`Failed to connect to database: ${error.message}`);
+        throw new Error(
+          `Failed to connect to database: ${error.message}`
+        );
       }
-      logger == null ? void 0 : logger.warn(`Failed to connect to database: ${error.message}`);
+      logger == null ? void 0 : logger.warn(
+        `Failed to connect to database: ${error.message}`
+      );
     }
   }
   async addKey(key) {
-    await this.withTimeout(this.database.collection(this.path).doc(key.kid).set({
-      kid: key.kid,
-      key: JSON.stringify(key)
-    }));
+    await this.withTimeout(
+      this.database.collection(this.path).doc(key.kid).set({
+        kid: key.kid,
+        key: JSON.stringify(key)
+      })
+    );
   }
   async listKeys() {
-    const keys = await this.withTimeout(this.database.collection(this.path).get());
+    const keys = await this.withTimeout(
+      this.database.collection(this.path).get()
+    );
     return {
       items: keys.docs.map((key) => ({
         key: key.data(),
@@ -2465,13 +2896,17 @@ class FirestoreKeyStore {
   }
   async removeKeys(kids) {
     for (const kid of kids) {
-      await this.withTimeout(this.database.collection(this.path).doc(kid).delete());
+      await this.withTimeout(
+        this.database.collection(this.path).doc(kid).delete()
+      );
     }
   }
   async withTimeout(operation) {
-    const timer = new Promise((_, reject) => setTimeout(() => {
-      reject(new Error(`Operation timed out after ${this.timeout}ms`));
-    }, this.timeout));
+    const timer = new Promise(
+      (_, reject) => setTimeout(() => {
+        reject(new Error(`Operation timed out after ${this.timeout}ms`));
+      }, this.timeout)
+    );
     return Promise.race([operation, timer]);
   }
   async verify() {
@@ -2499,15 +2934,20 @@ class KeyStores {
     }
     if (provider === "firestore") {
       const settings = ks == null ? void 0 : ks.getConfig(provider);
-      const keyStore = await FirestoreKeyStore.create(lodash.pickBy({
-        projectId: settings == null ? void 0 : settings.getOptionalString("projectId"),
-        keyFilename: settings == null ? void 0 : settings.getOptionalString("keyFilename"),
-        host: settings == null ? void 0 : settings.getOptionalString("host"),
-        port: settings == null ? void 0 : settings.getOptionalNumber("port"),
-        ssl: settings == null ? void 0 : settings.getOptionalBoolean("ssl"),
-        path: settings == null ? void 0 : settings.getOptionalString("path"),
-        timeout: settings == null ? void 0 : settings.getOptionalNumber("timeout")
-      }, (value) => value !== void 0));
+      const keyStore = await FirestoreKeyStore.create(
+        lodash.pickBy(
+          {
+            projectId: settings == null ? void 0 : settings.getOptionalString("projectId"),
+            keyFilename: settings == null ? void 0 : settings.getOptionalString("keyFilename"),
+            host: settings == null ? void 0 : settings.getOptionalString("host"),
+            port: settings == null ? void 0 : settings.getOptionalNumber("port"),
+            ssl: settings == null ? void 0 : settings.getOptionalBoolean("ssl"),
+            path: settings == null ? void 0 : settings.getOptionalString("path"),
+            timeout: settings == null ? void 0 : settings.getOptionalNumber("timeout")
+          },
+          (value) => value !== void 0
+        )
+      );
       await FirestoreKeyStore.verifyConnection(keyStore, logger);
       return keyStore;
     }
@@ -2564,10 +3004,12 @@ class CatalogIdentityClient {
       const missingEntityNames = resolvedEntityRefs.map(catalogModel.stringifyEntityRef).filter((s) => !foundEntityNames.includes(s));
       logger == null ? void 0 : logger.debug(`Entities not found for refs ${missingEntityNames.join()}`);
     }
-    const memberOf = entities.flatMap((e) => {
-      var _a, _b;
-      return (_b = (_a = e.relations) == null ? void 0 : _a.filter((r) => r.type === catalogModel.RELATION_MEMBER_OF).map((r) => r.targetRef)) != null ? _b : [];
-    });
+    const memberOf = entities.flatMap(
+      (e) => {
+        var _a, _b;
+        return (_b = (_a = e.relations) == null ? void 0 : _a.filter((r) => r.type === catalogModel.RELATION_MEMBER_OF).map((r) => r.targetRef)) != null ? _b : [];
+      }
+    );
     const newEntityRefs = [
       ...new Set(resolvedEntityRefs.map(catalogModel.stringifyEntityRef).concat(memberOf))
     ];
@@ -2578,7 +3020,9 @@ class CatalogIdentityClient {
 
 function getDefaultOwnershipEntityRefs(entity) {
   var _a, _b;
-  const membershipRefs = (_b = (_a = entity.relations) == null ? void 0 : _a.filter((r) => r.type === catalogModel.RELATION_MEMBER_OF && r.targetRef.startsWith("group:")).map((r) => r.targetRef)) != null ? _b : [];
+  const membershipRefs = (_b = (_a = entity.relations) == null ? void 0 : _a.filter(
+    (r) => r.type === catalogModel.RELATION_MEMBER_OF && r.targetRef.startsWith("group:")
+  ).map((r) => r.targetRef)) != null ? _b : [];
   return Array.from(/* @__PURE__ */ new Set([catalogModel.stringifyEntityRef(entity), ...membershipRefs]));
 }
 class CatalogAuthResolverContext {
@@ -2594,7 +3038,13 @@ class CatalogAuthResolverContext {
       catalogApi: options.catalogApi,
       tokenManager: options.tokenManager
     });
-    return new CatalogAuthResolverContext(options.logger, options.tokenIssuer, catalogIdentityClient, options.catalogApi, options.tokenManager);
+    return new CatalogAuthResolverContext(
+      options.logger,
+      options.tokenIssuer,
+      catalogIdentityClient,
+      options.catalogApi,
+      options.tokenManager
+    );
   }
   async issueToken(params) {
     const token = await this.tokenIssuer.issueToken(params);
@@ -2619,7 +3069,10 @@ class CatalogAuthResolverContext {
       const res = await this.catalogApi.getEntities({ filter }, { token });
       result = res.items;
     } else if ("filter" in query) {
-      const res = await this.catalogApi.getEntities({ filter: query.filter }, { token });
+      const res = await this.catalogApi.getEntities(
+        { filter: query.filter },
+        { token }
+      );
       result = res.items;
     } else {
       throw new errors.InputError("Invalid user lookup query");
@@ -2675,12 +3128,14 @@ async function createRouter(options) {
   if (secret) {
     router.use(cookieParser__default["default"](secret));
     const enforceCookieSSL = authUrl.startsWith("https");
-    router.use(session__default["default"]({
-      secret,
-      saveUninitialized: false,
-      resave: false,
-      cookie: { secure: enforceCookieSSL ? "auto" : false }
-    }));
+    router.use(
+      session__default["default"]({
+        secret,
+        saveUninitialized: false,
+        resave: false,
+        cookie: { secure: enforceCookieSSL ? "auto" : false }
+      })
+    );
     router.use(passport__default["default"].initialize());
     router.use(passport__default["default"].session());
   } else {
@@ -2695,7 +3150,9 @@ async function createRouter(options) {
   const providersConfig = config.getConfig("auth.providers");
   const configuredProviders = providersConfig.keys();
   const isOriginAllowed = createOriginFilter(config);
-  for (const [providerId, providerFactory] of Object.entries(allProviderFactories)) {
+  for (const [providerId, providerFactory] of Object.entries(
+    allProviderFactories
+  )) {
     if (configuredProviders.includes(providerId)) {
       logger.info(`Configuring provider, ${providerId}`);
       try {
@@ -2724,28 +3181,37 @@ async function createRouter(options) {
         }
         if (provider.refresh) {
           r.get("/refresh", provider.refresh.bind(provider));
+          r.post("/refresh", provider.refresh.bind(provider));
         }
         router.use(`/${providerId}`, r);
       } catch (e) {
         errors.assertError(e);
         if (process.env.NODE_ENV !== "development") {
-          throw new Error(`Failed to initialize ${providerId} auth provider, ${e.message}`);
+          throw new Error(
+            `Failed to initialize ${providerId} auth provider, ${e.message}`
+          );
         }
         logger.warn(`Skipping ${providerId} auth provider, ${e.message}`);
         router.use(`/${providerId}`, () => {
-          throw new errors.NotFoundError(`Auth provider registered for '${providerId}' is misconfigured. This could mean the configs under auth.providers.${providerId} are missing or the environment variables used are not defined. Check the auth backend plugin logs when the backend starts to see more details.`);
+          throw new errors.NotFoundError(
+            `Auth provider registered for '${providerId}' is misconfigured. This could mean the configs under auth.providers.${providerId} are missing or the environment variables used are not defined. Check the auth backend plugin logs when the backend starts to see more details.`
+          );
         });
       }
     } else {
       router.use(`/${providerId}`, () => {
-        throw new errors.NotFoundError(`No auth provider registered for '${providerId}'`);
+        throw new errors.NotFoundError(
+          `No auth provider registered for '${providerId}'`
+        );
       });
     }
   }
-  router.use(createOidcRouter({
-    tokenIssuer,
-    baseUrl: authUrl
-  }));
+  router.use(
+    createOidcRouter({
+      tokenIssuer,
+      baseUrl: authUrl
+    })
+  );
   router.use("/:provider/", (req) => {
     const { provider } = req.params;
     throw new errors.NotFoundError(`Unknown auth provider '${provider}'`);
@@ -2756,8 +3222,12 @@ function createOriginFilter(config) {
   var _a;
   const appUrl = config.getString("app.baseUrl");
   const { origin: appOrigin } = new URL(appUrl);
-  const allowedOrigins = config.getOptionalStringArray("auth.experimentalExtraAllowedOrigins");
-  const allowedOriginPatterns = (_a = allowedOrigins == null ? void 0 : allowedOrigins.map((pattern) => new minimatch.Minimatch(pattern, { nocase: true, noglobstar: true }))) != null ? _a : [];
+  const allowedOrigins = config.getOptionalStringArray(
+    "auth.experimentalExtraAllowedOrigins"
+  );
+  const allowedOriginPatterns = (_a = allowedOrigins == null ? void 0 : allowedOrigins.map(
+    (pattern) => new minimatch.Minimatch(pattern, { nocase: true, noglobstar: true })
+  )) != null ? _a : [];
   return (origin) => {
     if (origin === appOrigin) {
       return true;