From 2156a78740eebb427053a2bc42e4cbe6e5c1c78d Mon Sep 17 00:00:00 2001
From: Vaibhav Pathak <vaibhav.pathak@Vaibhavs-MacBook-Air.local>
Date: Fri, 16 Jan 2026 14:39:42 +0530
Subject: [PATCH] Add configurable allowed email domains for Google OAuth

- Add auth.allowedEmailDomains configuration
- Configure onlinesales.ai as allowed domain
- Remove signIn resolver config (moved to backend code)
- Add documentation comments

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 templates/backstage-configmap.yaml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/templates/backstage-configmap.yaml b/templates/backstage-configmap.yaml
index 4664951..e06ab67 100644
--- a/templates/backstage-configmap.yaml
+++ b/templates/backstage-configmap.yaml
@@ -45,15 +45,19 @@ data:
       environment: production
       session:
         secret: ${BACKEND_SECRET}
+      # Configure allowed email domains for Google OAuth
+      # Users with these email domains can sign in without User entities in catalog
+      allowedEmailDomains:
+        - onlinesales.ai
+        # Add more domains if needed:
+        # - partner-company.com
       providers:
         google:
           production:
             clientId: ${AUTH_GOOGLE_CLIENT_ID}
             clientSecret: ${AUTH_GOOGLE_CLIENT_SECRET}
-            signIn:
-              resolvers:
-              # See https://backstage.io/docs/auth/google/provider#resolvers for more resolvers
-                - resolver: emailLocalPartMatchingUserEntityName
+            # Custom domain-based resolver is configured in backend code
+            # See packages/backend/src/plugins/auth.ts
 
     integrations:
       gitea: