Backstage OIDC
You set up backstage oidc by linking your identity provider to the portal auth backend. Then you write a sign-in resolver that maps each login token to a catalog user. Platform teams use this setup to give developers one login for their internal portal. Still, broad portal roles often grant too much power over linked cloud tools and databases. When every developer gets the same group claim, anyone can trigger risky backend actions. How backstage oidc login and user mapping work OpenID Connect
Backstage Security Plugins + K8s OIDC Authentication: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up backstage oidc by linking your identity provider to the portal auth backend. Then you write a sign-in resolver that maps each login token to a catalog user. Platform teams use this setup to give developers one login for their internal portal. Still, broad portal roles often grant too much power over linked cloud tools and databases. When every developer gets the same group claim, anyone can trigger risky backend actions.
How backstage oidc login and user mapping work
OpenID Connect lets your portal trust an external login provider like Okta or Keycloak. First, you register the portal as a client app inside your identity provider. The provider gives you a client ID, a client secret, and a metadata URL. You add those values to the portal backend settings so the two apps can talk.
Next, a developer clicks the login button in the portal user interface. The browser sends the developer to the identity provider login page to check their identity. Once the developer logs in, the provider sends an identity token back to the portal. This token holds claims like the user email, full name, and team group names.
The portal backend must still match that external token to an internal catalog user. A sign-in resolver reads the email claim from the token and checks the catalog. If the user exists in the catalog, the backend issues a portal session token. This session token holds the user identity and group claims for future portal requests.
Why team group claims need careful role design
Group claims in the login token tell the portal which teams a developer belongs to. Portal plugins read these group claims to decide who can see or run specific tools. Many teams pass every identity provider group straight into the portal session token. That choice makes initial setup fast, but it creates problems as the team grows.
First, large group lists can make the portal token too big for standard web headers. Second, coarse groups like an all-engineering role give every developer the same portal permissions. A junior developer and a staff engineer end up with the exact same access level. You should filter group claims during login so only needed team roles enter the portal.
Teams also need a clear plan for users who leave the company. When an admin removes a user from the identity provider, the catalog must update too. You should sync your user catalog with your identity provider on a regular schedule. This sync stops old accounts from lingering in team ownership lists.
Backstage Security Plugins + K8s OIDC Authentication: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What portal login solves and what it leaves open
A good backstage oidc setup solves the problem of knowing who enters your developer portal. It stops anonymous users from viewing your software catalog, tech docs, or service templates. It also gives plugin builders a standard way to check team membership inside the portal.
Still, portal login only controls the front door of the developer web app. It does not control what happens when a developer connects to a real production database. It also cannot check single commands run against a cloud server or Kubernetes cluster. Once a plugin or developer holds a backend key, the portal cannot inspect live traffic.
Login checks decide who gets into the app, not what individual queries do in flight. A developer with valid portal access can still run a drop table command by mistake. They can also query tables that hold raw customer emails, phone numbers, or card numbers. Protecting live data takes controls that work at the command and query level.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why does backstage oidc login fail when a user is missing from the catalog?
Most sign-in resolvers require a matching user entity in the software catalog before issuing a token. You must import your users from your identity provider or write a custom resolver rule.
How does backstage oidc handle user group claims from an identity provider?
The auth backend reads group claims from the provider token during the sign-in step. The resolver then links those groups to ownership refs inside the portal session token.
Does backstage oidc control what queries a developer runs on a database?
No, portal login only verifies user identity when they open the web app. It does not inspect or block live SQL queries or server commands outside the portal.