[RFC] Auth Redirect

Status: Open for comments

Need

In the Auth plugin in Backstage, when a request comes for authentication, Backstage detects the redirect URL from the app-config.yaml file which can be just an URL. At Spotify, we deploy UIs in a test environment that has a different URL than the production one. We need Backstage to be able to redirect back to a list of valid URLs.

Current state

Now we can have only one URL as the app.baseUrl in the app-config.yaml file.

Proposal

I propose to add a possibility to handle the redirection by keeping the original URL in a stateless way (in OAuth you generally pass the URL to redirect back as a query param). Also accepting a pattern for defining valid URLs, like *.example.com which provides the possibility of passing a list of valid URLs.

Alternatives

Risks

[freben]

Hmm.

Usually you would only need one such param per deployment right? What we usually do is to have config that changes per deployment; by merging in several config files and/or using env variable substitution in the config. Could you set the base url and/or redirect to be something like ${TESTRUNNER_DEPLOYMENT_URL}/api/... in an app-config.testrunner.yaml that’s only used in the test env? Or does that not help with this situation

[Rugvip]

Closed by #6772