Skip to content

onboard pingfederate auth provider plugin as dynamic - #3259

Open
JessicaJHee wants to merge 1 commit into
redhat-developer:mainfrom
JessicaJHee:onboard-auth-providers-pingfederate
Open

onboard pingfederate auth provider plugin as dynamic#3259
JessicaJHee wants to merge 1 commit into
redhat-developer:mainfrom
JessicaJHee:onboard-auth-providers-pingfederate

Conversation

@JessicaJHee

Copy link
Copy Markdown
Member

Summary

Fixes RHIDP-16098

Onboard auth backend provider modules as supported plugins (on BS 1.52.0). These were originally statically installed in RHDH core here, but for 2.1 we are decoupling them and provide ability to install them dynamically.

  • @backstage-community/plugin-auth-backend-module-pingfederate-provider

Changes

Adds package metadata, rhdh-supported-packages.txt entries, and default.packages.yaml (not OOTB enabled)

  • removes catalog-backend-module-pingidentity as it was not meant to be GA, only the auth provider should be GA

Collateral changes

  • Updates pingidentity source.json to 1.52.0

@JessicaJHee
JessicaJHee requested review from a team, gashcrumb and kadel as code owners August 12, 2026 18:57
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 12, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:58 PM UTC · Completed 7:15 PM UTC

Commit: 6ce343a · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 12, 2026

Copy link
Copy Markdown

Review — comment

PR #3259 onboards the PingFederate auth backend provider module (@backstage-community/plugin-auth-backend-module-pingfederate-provider) as a GA-supported dynamic plugin, adds the required metadata, and updates the supported-packages list to replace the catalog-backend-module-pingidentity entry (which is being reclassified from "heading to GA" to remaining as tech-preview only).

The PR follows the documented onboarding process for adding a new plugin to an existing workspace. The plugins-list.yaml and source.json are already in place on main. The metadata, default.packages.yaml entry, coverage anchor, and smoke-test env vars are all appropriate additions.

Findings

1. partOf self-reference instead of Plugin entity group name

Severity: medium · Category: correctness — partOf convention

File: workspaces/pingidentity/metadata/backstage-community-plugin-auth-backend-module-pingfederate-provider.yaml (line 30)

The partOf field references the Package's own name (backstage-community-plugin-auth-backend-module-pingfederate-provider) instead of the parent Plugin entity group name. The sibling Package in this workspace (backstage-community-plugin-catalog-backend-module-pingidentity.yaml) uses partOf: - pingidentity, which matches the Plugin entity at catalog-entities/extensions/plugins/pingidentity.yaml. This is the dominant convention across all community-plugin workspaces (e.g., kiali, argocd, topology, rbac all use short workspace-level names).

A self-referential partOf means this Package won't be associated with the pingidentity Plugin entity, breaking the plugin-to-package relationship in the extensions catalog.

Suggested fix: Change partOf from - backstage-community-plugin-auth-backend-module-pingfederate-provider to - pingidentity.


2. Plugin entity spec.packages not updated with new Package

Severity: medium · Category: correctness — consumer completeness

File: catalog-entities/extensions/plugins/pingidentity.yaml (line 53)

The Plugin entity currently lists only backstage-community-plugin-catalog-backend-module-pingidentity in spec.packages. The new auth provider Package is not added. Without this, the extensions catalog UI won't show the PingFederate auth provider as part of the PingIdentity plugin.

Suggested fix: Add - backstage-community-plugin-auth-backend-module-pingfederate-provider to spec.packages in catalog-entities/extensions/plugins/pingidentity.yaml.


3. Smoke-test comment references "keycloak" instead of "pingfederate"

Severity: medium · Category: correctness — copy-paste error

File: workspaces/pingidentity/smoke-tests/test.env

The newly added comment reads: "Disable RHDH's static authProvidersModule so the dynamic keycloak provider can register without 'No auth provider found for keycloak'." This is in the pingidentity workspace and accompanies PINGFEDERATE_* env vars. This appears to be copied from a keycloak workspace context and will mislead future maintainers.

Suggested fix: Replace "keycloak" with "pingfederate" in both places in the comment.


4. Missing trailing newline in test.env

Severity: low · Category: style — missing-newline

File: workspaces/pingidentity/smoke-tests/test.env

The diff shows \ No newline at end of file. POSIX text files should end with a newline. Some shell/env-file parsers may silently drop the last line, which would prevent ENABLE_AUTH_PROVIDER_MODULE_OVERRIDE=true from being applied.


5. Source-location annotation inconsistency within workspace

Severity: low · Category: style — source-location consistency

File: workspaces/pingidentity/metadata/backstage-community-plugin-auth-backend-module-pingfederate-provider.yaml

The backstage.io/source-location annotation and Source Code link point to the plugin-specific subdirectory (.../plugins/auth-backend-module-pingfederate-provider), while the sibling metadata file points to the workspace root (.../workspaces/pingidentity). Both patterns exist in the repo, but the inconsistency within the same workspace is notable.


6. Supported-packages list replacement is intentional but worth confirming

Severity: low · Category: intent — scope clarification

File: rhdh-supported-packages.txt (line 59)

The PR replaces catalog-backend-module-pingidentity with auth-backend-module-pingfederate-provider in the supported packages list. The PR description explicitly states this is intentional ("removes catalog-backend-module-pingidentity as it was not meant to be GA"). The old plugin's metadata and default.packages.yaml entry remain as tech-preview, which is consistent with keeping it available but withdrawing the GA path.


Summary

The core onboarding is well-structured and follows repo conventions. The three medium findings — partOf self-reference (finding 1), missing Plugin entity update (finding 2), and the copy-paste comment (finding 3) — are worth addressing in this PR to ensure the plugin is properly discoverable in the extensions catalog and the smoke-test configuration is accurate. None of these block the plugin from being built or deployed.


Labels: PR onboards a new workspace plugin and modifies the supported-packages list.

Previous run

Review — comment

This PR onboards the @backstage-community/plugin-auth-backend-module-pingfederate-provider as a dynamic plugin within the existing pingidentity workspace. The change adds Package metadata, coverage anchor, smoke-test env vars, default.packages.yaml entry (disabled, GA), and updates rhdh-supported-packages.txt to replace the catalog module with the auth provider on the GA track. A collateral change adds ENABLE_AUTH_PROVIDER_MODULE_OVERRIDE=true to the backstage workspace's smoke tests to handle the static-to-dynamic auth provider transition.

The diff is well-structured and follows established workspace onboarding patterns. The metadata, OCI artifact reference (bs_1.52.0__0.2.0), smoke-test env vars, and default.packages.yaml entry are all internally consistent. The source.json already references Backstage 1.52.0 and the plugins-list.yaml already includes the auth provider plugin path.

Findings

1. partOf self-reference in new Package entity — medium

File: workspaces/pingidentity/metadata/backstage-community-plugin-auth-backend-module-pingfederate-provider.yaml (line 29)

The new Package entity sets partOf: [backstage-community-plugin-auth-backend-module-pingfederate-provider], which references its own metadata.name. Every other Package entity in the repository references the Plugin entity name — for example, the existing catalog module in the same workspace uses partOf: [pingidentity], and the keycloak catalog module uses partOf: [keycloak-catalog-integration].

This self-reference means the Package won't be linked to any Plugin entity in the Extensions UI. It should either reference pingidentity (the existing Plugin entity) or, if the auth provider warrants a separate Extensions UI entry, a new Plugin entity should be created for PingFederate and referenced here.

Remediation: Change partOf to reference the appropriate Plugin entity name. If using the existing one: partOf: [pingidentity]. If a separate Plugin entity is needed for PingFederate auth, create the Plugin YAML in catalog-entities/extensions/plugins/ and reference its name.

2. Plugin entity spec.packages not updated — medium

File: catalog-entities/extensions/plugins/pingidentity.yaml (line 53)

The pingidentity Plugin entity's spec.packages only lists backstage-community-plugin-catalog-backend-module-pingidentity. The new auth provider Package is not included. Without this addition (or a separate dedicated Plugin entity for PingFederate), the auth provider won't appear under any plugin in the Extensions UI catalog.

If the auth provider should appear under the existing PingIdentity plugin, add the new package to spec.packages. If it should appear separately, create a new Plugin entity and add it to catalog-entities/extensions/plugins/all.yaml.

Note: the existing Plugin entity's support level is tech-preview while the new Package is generally-available. If both packages remain under the same Plugin entity, the Plugin-level support should be reconciled with the different support levels of its packages.

Remediation: Either add backstage-community-plugin-auth-backend-module-pingfederate-provider to the existing pingidentity.yaml Plugin entity's spec.packages list, or create a separate Plugin entity for the PingFederate auth provider.

3. Missing trailing newline — low

File: workspaces/backstage/smoke-tests/test.env

The file ends without a trailing newline after the ENABLE_AUTH_PROVIDER_MODULE_OVERRIDE=true line (diff shows \ No newline at end of file). This is a minor POSIX convention violation that can cause issues with some text processing tools.

Remediation: Add a trailing newline to the end of the file.

Previous run (2)

Review

Findings

Medium

  • [logic-error] workspaces/pingidentity/metadata/backstage-community-plugin-auth-backend-module-pingfederate-provider.yaml:31 — The partOf field references backstage-community-plugin-auth-backend-module-pingfederate-provider, which is the package's own metadata.name. Across all ~146 metadata files in the repository, every partOf uses a short logical group name (e.g., pingidentity, scorecard, tekton). The sibling package uses partOf: - pingidentity. This self-referential value prevents the package from being associated with the pingidentity Plugin entity in the extensions UI.
    Remediation: Change partOf from - backstage-community-plugin-auth-backend-module-pingfederate-provider to - pingidentity.

  • [incomplete-change] catalog-entities/extensions/plugins/pingidentity.yaml:53 — The pingidentity Plugin entity's spec.packages list only includes backstage-community-plugin-catalog-backend-module-pingidentity. The new package should be added for bidirectional referencing.
    Remediation: Add - backstage-community-plugin-auth-backend-module-pingfederate-provider to the packages list in catalog-entities/extensions/plugins/pingidentity.yaml.

Low

  • [scope-mismatch] rhdh-supported-packages.txt — The diff replaces catalog-backend-module-pingidentity with auth-backend-module-pingfederate-provider in the GA track. The PR body explains the rationale but the linked issue (RHIDP-16098) is about onboarding, not de-listing. Confirm the GA track removal is authorized.

  • [stale-reference] rhdh-supported-packages.txt:58 — The new entry inherits the section comment "heading to GA per 11/12 meeting," which originally applied to the catalog module and may not apply to the auth provider.

fullsend-ai-review[bot]

This comment was marked as outdated.

@JessicaJHee

Copy link
Copy Markdown
Member Author

/publish

@github-actions

Copy link
Copy Markdown
Contributor

Publish workflow has completed with success.

Publishing process

✅ Finished successfully.

✅ Published container images:

  • ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-catalog-backend-module-pingidentity:pr_3259__0.13.0
  • ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-auth-backend-module-pingfederate-provider:pr_3259__0.2.0

Backstage Compatibility Check

✅ All workspaces are compatible with the target Backstage version (1.52.0).

No action required.

Metadata Validation

✅ All metadata files validated successfully.

No E2E tests available for this workspace.

@github-actions

Copy link
Copy Markdown
Contributor


Smoke tests workflow failed.

⚠️ Smoke tests failed. Check the workflow logs for details.

These plugins failed to load:
(log-errors)

Error logs from container
�[2m2026-08-12T19:26:46.503Z�[22m �[34mbackstage�[39m �[32minfo�[39m Plugin initialization started: 'app', 'auth', 'catalog', 'dynamic-plugins-info', 'events', 'healthcheck', 'licensed-users-info', 'permission', 'proxy', 'scaffolder', 'scalprum', 'search', 'translations', 'user-settings' �[36mtype�[39m="initialization"
�[2m2026-08-12T19:26:46.596Z�[22m �[34msearch�[39m �[33mwarn�[39m Postgres search engine is not supported, skipping registration of search-backend-module-pg 
�[2m2026-08-12T19:26:46.596Z�[22m �[34mbackstage�[39m �[31merror�[39m Module auth-providers in Plugin 'auth' threw an error during startup, waiting for 12 other plugins to finish before shutting down the process. No auth provider found for pingfederate �[36mtype�[39m="initialization" �[36mstack�[39m="Error: No auth provider found for pingfederate\n    at getAuthProviderFactory (/opt/app-root/src/packages/backend/dist/modules/authProvidersModule.cjs.js:200:13)\n    at /opt/app-root/src/packages/backend/dist/modules/authProvidersModule.cjs.js:231:27\n    at Array.forEach (<anonymous>)\n    at Object.init [as func] (/opt/app-root/src/packages/backend/dist/modules/authProvidersModule.cjs.js:227:65)\n    at /opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackendInitializer.cjs.js:325:41\n    at async processNode (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/lib/DependencyGraph.cjs.js:181:22)\n    at async Promise.all (index 1)\n    at async processMoreNodes (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/lib/DependencyGraph.cjs.js:176:7)\n    at async DependencyGraph.parallelTopologicalTraversal (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/lib/DependencyGraph.cjs.js:195:5)\n    at async /opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackendInitializer.cjs.js:316:13\n    at async Promise.all (index 8)\n    at async #doStart (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackendInitializer.cjs.js:291:5)\n    at async BackendInitializer.start (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackendInitializer.cjs.js:237:12)\n    at async BackstageBackend.start (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackstageBackend.cjs.js:23:12)"
�[2m2026-08-12T19:26:46.610Z�[22m �[34mlicensed-users-info�[39m �[33mwarn�[39m The plugin-licensed-users-info-backend was disabled because it does not support the SQLite in-memory database configuration. 
�[2m2026-08-12T19:26:46.617Z�[22m �[34mevents�[39m �[32minfo�[39m Database is not PostgreSQL, using memory store 
�[2m2026-08-12T19:26:47.479Z�[22m �[34mpermission�[39m �[33mwarn�[39m RBAC backend plugin was disabled by application config permission.enabled: false 
�[2m2026-08-12T19:26:47.480Z�[22m �[34mpermission�[39m �[33mwarn�[39m Permission backend started with permissions disabled. Enable permissions by setting permission.enabled=true. 
�[2m2026-08-12T19:26:47.597Z�[22m �[34mbackstage�[39m �[31merror�[39m Unhandled rejection getaddrinfo ENOTFOUND smoke-test.example.com �[36mtype�[39m="unhandledRejection" �[36merrno�[39m=-3008 �[36mcode�[39m="ENOTFOUND" �[36msyscall�[39m="getaddrinfo" �[36mhostname�[39m="smoke-test.example.com" �[36mstack�[39m="Error: getaddrinfo ENOTFOUND smoke-test.example.com\n    at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:122:26)"
�[2m2026-08-12T19:26:47.602Z�[22m �[34mbackstage�[39m �[32minfo�[39m Plugin initialization in progress, newly initialized: 'healthcheck', 'translations', 'proxy', 'scalprum', 'dynamic-plugins-info', 'licensed-users-info', 'events', 'search', 'auth', 'user-settings', 'permission', 'scaffolder', still initializing: 'app', 'catalog' �[36mtype�[39m="initialization"
�[2m2026-08-12T19:26:47.613Z�[22m �[34mcatalog�[39m �[32minfo�[39m Registered scheduled task: PingIdentityEntityProvider:default:refresh, {"version":2,"cadence":"PT30M","initialDelayDuration":"PT15S","timeoutAfterDuration":"PT10M"} �[36mtask�[39m="PingIdentityEntityProvider:default:refresh"
�[2m2026-08-12T19:26:48.069Z�[22m �[34mapp�[39m �[32minfo�[39m Storing 0 updated assets and 373 new assets 
�[2m2026-08-12T19:26:48.235Z�[22m �[34mbackstage�[39m �[32minfo�[39m Plugin initialization complete, newly initialized: 'catalog', 'app' �[36mtype�[39m="initialization"
�[2m2026-08-12T19:26:48.235Z�[22m �[34mbackstage�[39m �[31merror�[39m Unhandled rejection Backend startup failed due to the following errors:
  Module 'auth-providers' for plugin 'auth' startup failed; caused by Error: No auth provider found for pingfederate �[36mtype�[39m="unhandledRejection" �[36mcause�[39m=undefined �[36mname�[39m="BackendStartupError" �[36mstack�[39m="BackendStartupError: Backend startup failed due to the following errors:\n  Module 'auth-providers' for plugin 'auth' startup failed; caused by Error: No auth provider found for pingfederate\n    at #doStart (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackendInitializer.cjs.js:359:13)\n    at async BackendInitializer.start (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackendInitializer.cjs.js:237:12)\n    at async BackstageBackend.start (/opt/app-root/src/node_modules/@backstage/backend-app-api/dist/wiring/BackstageBackend.cjs.js:23:12)"
�[2m2026-08-12T19:26:49.012Z�[22m �[34mrootHttpRouter�[39m �[32minfo�[39m [2026-08-12T19:26:49.012Z] "GET /health HTTP/1.1" 200 1955 "-" "curl/8.5.0" �[36mtype�[39m="incomingRequest" �[36mdate�[39m="2026-08-12T19:26:49.012Z" �[36mmethod�[39m="GET" �[36murl�[39m="/health" �[36mstatus�[39m=200 �[36mhttpVersion�[39m="1.1" �[36muserAgent�[39m="curl/8.5.0" �[36mcontentLength�[39m=1955

@github-actions github-actions Bot added mandatory-workspace PR affects a workspace with required plugins for releases workspace-update PR modifies files in an existing workspace labels Aug 12, 2026
@JessicaJHee
JessicaJHee force-pushed the onboard-auth-providers-pingfederate branch from 6ce343a to 65f02f8 Compare August 12, 2026 21:18
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 12, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 9:19 PM UTC · Completed 9:24 PM UTC

Commit: 65f02f8 · View workflow run →

@fullsend-ai-review
fullsend-ai-review Bot dismissed their stale review August 12, 2026 21:24

Superseded by updated review

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Aug 12, 2026
@github-actions github-actions Bot removed workspace-update PR modifies files in an existing workspace mandatory-workspace PR affects a workspace with required plugins for releases labels Aug 13, 2026
@JessicaJHee

Copy link
Copy Markdown
Member Author

/publish

@github-actions

Copy link
Copy Markdown
Contributor

PR action (/publish) cancelled: PR doesn't touch only 1 workspace.

@JessicaJHee
JessicaJHee force-pushed the onboard-auth-providers-pingfederate branch from 65f02f8 to 5ddfb0e Compare August 13, 2026 14:49
Signed-off-by: Jessica He <jhe@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@JessicaJHee
JessicaJHee force-pushed the onboard-auth-providers-pingfederate branch from 5ddfb0e to ab863a2 Compare August 13, 2026 14:49
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 13, 2026

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 2:49 PM UTC · Ended 2:50 PM UTC

Commit: 5ddfb0e · View workflow run →

@JessicaJHee

Copy link
Copy Markdown
Member Author

/publish

@sonarqubecloud

Copy link
Copy Markdown

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 13, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 2:51 PM UTC · Ended 3:03 PM UTC

Commit: ab863a2 · View workflow run →

@github-actions

Copy link
Copy Markdown
Contributor

Publish workflow has completed with success.

Publishing process

✅ Finished successfully.

✅ Published container images:

  • ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-catalog-backend-module-pingidentity:pr_3259__0.13.0
  • ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-auth-backend-module-pingfederate-provider:pr_3259__0.2.0

Backstage Compatibility Check

✅ All workspaces are compatible with the target Backstage version (1.52.0).

No action required.

Metadata Validation

✅ All metadata files validated successfully.

No E2E tests available for this workspace.

@github-actions

Copy link
Copy Markdown
Contributor

Smoke tests workflow passed. All plugins loaded successfully.

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

lifecycle: active
partOf:
- backstage-community-plugin-auth-backend-module-pingfederate-provider
appConfigExamples:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] correctness

The partOf field references the Package's own name instead of the parent Plugin entity group name. The sibling Package uses partOf: - pingidentity, matching the Plugin entity. A self-referential partOf breaks the plugin-to-package relationship in the extensions catalog.

Suggested fix: Change partOf from '- backstage-community-plugin-auth-backend-module-pingfederate-provider' to '- pingidentity' to match the Plugin entity name and sibling convention.


# heading to GA per 11/12 meeting
pingidentity/plugins/catalog-backend-module-pingidentity
pingidentity/plugins/auth-backend-module-pingfederate-provider

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] intent

The PR replaces catalog-backend-module-pingidentity with auth-backend-module-pingfederate-provider. The old plugin's metadata and default.packages.yaml entry remain as tech-preview, consistent with withdrawing the GA path while keeping it available. The PR description documents this as intentional.

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment workspace-update PR modifies files in an existing workspace and removed requires-manual-review Review requires human judgment labels Aug 13, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:51 PM UTC · Completed 3:03 PM UTC

Commit: ab863a2 · View workflow run →

@github-actions github-actions Bot added the mandatory-workspace PR affects a workspace with required plugins for releases label Aug 13, 2026

@Zaperex Zaperex left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/publish

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lgtm mandatory-workspace PR affects a workspace with required plugins for releases requires-manual-review Review requires human judgment workspace-update PR modifies files in an existing workspace

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants