Setting up sign-in to Backstage with each identity provider, mapping identities to catalog users, and securing calls between backend plugins and from external callers.
Signing in to Backstage with Entra ID: the app registration, redirect URI, Graph permissions and admin consent, domain hint for multi-tenant users, and the four resolvers including the one for users without email.
Okta OIDC sign-in for Backstage: the Web Application setup, redirect and sign-out URIs, default and additional scopes such as groups, and matching Okta users to catalog users.
Using Keycloak as the Backstage identity provider with the generic OIDC module: client setup, metadata URL, re-badging the sign-in button, the custom API ref and resolving by email or sub. Separate from importing Keycloak org data.
GitHub OAuth sign-in for Backstage: OAuth app versus GitHub App, GitHub Enterprise hosts, the GitHub-specific user ID resolver, and keeping sign-in separate from the integration token used for catalog discovery.
Using the OpenShift auth provider so platform users sign in with their cluster identity, and how that compares with fronting Backstage with an authenticating proxy.
Letting a proxy handle sign-in: how proxy providers fetch the session, why AWS ALB, Google IAP and Cloudflare Access verify signatures, the risk with oauth2-proxy and when a proxy also protects the frontend bundle.
Choosing resolvers that cannot be abused: built-in email and annotation resolvers, allowedDomains, resolver order and NotFoundError, custom resolvers, and why signing in users without catalog entities is risky.
Securing calls into Backstage: plugin-to-plugin tokens, static tokens and JWKS for scripts and external systems, access restrictions by plugin and permission, and why disabling the default auth policy is a last resort.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.