Key for the ES256 algorithm must be one of type KeyObject or CryptoKey. Received an instance of Uint8Array about backstage HOT 11 OPEN

I see it fails on CatalogAuthResolverContext.ts when tries to get catalog entities await this.catalogApi.getEntityByRef(entityRef, { token });

from backstage.

Are you deployed behind a reverse proxy like for example oauth2proxy? Could it be configured to inject authorization headers of its own? We've seen some cases like that, where an intermediary proxy was ruining the Backstage token passing, so that the backend receiving the calls could not recognize the auth it received. Reconfiguring the proxy made the problem go away in those instances

from backstage.

the problem is it fails not on external call, but when tries to get catalog entity after successful auth in okta, so it fails on inter-module communication

from backstage.

"It" is the browser here, making a request to a backend plugin (catalog), am I understanding that correctly?

from backstage.

nope, auth plugin makes request to catalog plugin

from backstage.

When you did this upgrade to the new Backstage release, did you update both the auth plugin and the catalog plugin to the newest versions?

Is your backend instance migrated to the new backend system?

Did you have a custom TokenManager in place in your backend?

from backstage.

What do you mean by upgrading plugin to the newest version ? if backstage deps then yes

I migrated backend to the new backend system, but some internal plugins are still not migrated

I don't have custom TokenManager

from backstage.