🐛 Bug Report: TechDocs cookie authentication fails due to 'cookie was too large' about backstage HOT 3 OPEN

@kuangp

This implementation would change, to read the user info out of a new database table instead, keyed by the userEntityRef. The auth backend token issuance code should be updated to store all important user info upon each sign in (or rather, each token issuance?). At least the ownership refs, but in the future maybe more than that. And leave them out of the token itself.

Regarding the number of refs though: Even if you got rid of the token size issue, you'd still be paying a hefty cost for making these lists massive. In permissions checks etc these get translated to increasingly complex queries that affect the catalog etc.

While building this user info feature, would it instead be useful to return those "special" permissions strings as auxiliary data that the user info services retrieves, and which isn't mingled with the ownership claims themselves and their semantics? The vehicle for that could be custom token claims that just get stripped out and stored in the db, but perhaps the data types could instead be changed around the interaction surfaces here (the ctx methods and the sign in resolver etc) to make explicit room for the new user info mechanism?

from backstage.

We've implemented the starting point for fixing this more permanently through the new UserInfoService which moves this information out of the user token, https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution#userinfoservice-interface. It needs more implementation in the auth backend though, which isn't on our immediate roadmap.

Short term I'd recommend that you limit the number of ownership entity refs, although I'd also recommend this as a long-term goal too. The ownership entity refs are intended to point to groups that exist in your org that are able to own entities in the catalog, which entities then point to using the owner field and relation.

from backstage.

It needs more implementation in the auth backend though, which isn't on our immediate roadmap.

Kind of bummed to hear that this is not going to be finished being flushed out as part of the original BEP 😞
This is significantly affecting us as well and was really looking forward to being able to re-enable auth for techdocs ...

The ownership entity refs are intended to point to groups that exist in your org that are able to own entities in the catalog, which entities then point to using the owner field and relation.

This wasn't viable for us and probably for some other adopters too since we rely on these ownership claims to drive permissions for various plugins even if these groups themselves aren't owners of any entities in the catalog

@Rugvip do you mind laying out what's left to be implemented to get this fully working? I might take a stab at this when I have some spare time

from backstage.