How to enable sign-in with Google on Backstage? - google-oauth

Question

On Backstage, after following all the steps on https://backstage.io/docs/auth/google/provider, I get the message "The Google provider is not configured to support sign-in" after going through the Google SSO interface.
If I understood correctly, I have to setup Backstage to enable/allow Google provider to sign-in users. But I'm lost on how to do this.
How to configure Google provider to support sign-in on Backstage?

Answer 1

It seems you missed the backend app's auth plugin configuration as mentioned in the docs
You should create a resolver function to map the google user's identity to a backstage user's identity or, optionally, skip the catalog's user lookup ( there are caveats to this approach ).
The following documentation explains about the resolver function and user identities: Sign-in Identities and Resolvers
The following code is an example of how you would achieve a google resolver WITHOUT mapping to a backstage user identity and I recommend using it for testing purposes only and, as previosly mentioned, there are caveats to this approach.
I strongly recommend understanding the documentation and the power mapping the external user identity to a backstage user identity unleashes.
./packages/backend/src/plugins/auth.ts
import { createRouter, providers } from '#backstage/plugin-auth-backend';
import { Router } from 'express';
import { PluginEnvironment } from '../types';
import { DEFAULT_NAMESPACE, stringifyEntityRef, } from '#backstage/catalog-model';
export default async function createPlugin(
env: PluginEnvironment,
): Promise<Router> {
return await createRouter({
...env,
providerFactories: {
google: providers.google.create({
signIn: {
resolver: async ({ profile }, ctx) => {
if (!profile.email) {
throw new Error(
'Login failed, user profile does not contain an email',
);
}
const [localPart] = profile.email.split('#');
const userEntityRef = stringifyEntityRef({
kind: 'User',
name: localPart,
namespace: DEFAULT_NAMESPACE,
});
return ctx.issueToken({
claims: {
sub: userEntityRef,
ent: [userEntityRef],
},
});
},
},
}),
},
});
}