fix(auth): add dynamic auth providers

docs/api/deployment/deployment-types.md

@@ -24,7 +24,7 @@ Installation method for RHDH.
 ## AuthProvider
 
 ```typescript
-type AuthProvider = "guest" | "keycloak";
+type AuthProvider = "guest" | "keycloak" | "github";
 ```
 
 Authentication provider configuration.

docs/changelog.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file.
 
-## [2.1.9] - Current
+## [2.1.10] - Current
+
+### Fixed
+
+- **Auth provider dynamic plugins**: Guest, GitHub, and Keycloak (OIDC) auth profiles now enable the matching dynamic plugins. Auth providers are no longer installed statically.
+
+## [2.1.9]
 
 ### Changed
 

docs/guide/deployment/authentication.md

@@ -48,6 +48,8 @@ SKIP_KEYCLOAK_DEPLOYMENT=true yarn playwright test
 
 Keycloak provides OIDC authentication for realistic auth testing.
 
+This profile signs in with stock OIDC (`auth.providers.oidc`, `signInPage: oidc`) against a Keycloak IdP, and loads `oidc-provider` plus the Keycloak catalog module as dynamic plugins. You do not need to add those packages to the workspace `dynamic-plugins.yaml`.
+
 ### Configuration
 
 ```typescript
@@ -120,7 +122,7 @@ test.beforeAll(async ({ rhdh }) => {
 
 ## GitHub Authentication
 
-Allows authentication using github OAuth application. 
+Allows authentication using github OAuth application.
 
 ### Configuration
 
@@ -190,13 +192,15 @@ Package configs:
 │   └── rhdh-secrets.yaml
 └── auth/
     ├── guest/                 # Applied when auth: "guest"
-    │   └── app-config.yaml
+    │   ├── app-config.yaml
+    │   └── dynamic-plugins.yaml
     └── keycloak/              # Applied when auth: "keycloak"
     │   ├── app-config.yaml
     │   ├── dynamic-plugins.yaml
     │   └── secrets.yaml
     └── github/                # Applied when auth: "github"
         ├── app-config.yaml
+        ├── dynamic-plugins.yaml
         └── secrets.yaml
 ```
 

docs/guide/deployment/index.md

@@ -156,6 +156,7 @@ Configurations are merged in layers:
 ```
 Package defaults      → auth/guest/     → Your configs
                       → auth/keycloak/  →
+                      → auth/github/    →
 ```
 
 Later configurations override earlier ones, allowing you to customize only what you need.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@red-hat-developer-hub/e2e-test-utils",
-  "version": "2.1.9",
+  "version": "2.1.10",
   "description": "Test utilities for RHDH E2E tests",
   "license": "Apache-2.0",
   "repository": {

src/deployment/rhdh/config/auth/github/dynamic-plugins.yaml

@@ -0,0 +1,12 @@
+plugins:
+  # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-github-provider:{{inherit}} once published on quay
+  - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-github-provider:bs_1.52.0__0.5.4
+    disabled: false
+    pluginConfig:
+      auth:
+        providers:
+          github:
+            production:
+              clientId: ${GITHUB_OAUTH_APP_ID}
+              clientSecret: ${GITHUB_OAUTH_APP_SECRET}
+              callbackUrl: ${RHDH_BASE_URL}/api/auth/github/handler/frame

src/deployment/rhdh/config/auth/guest/dynamic-plugins.yaml

@@ -0,0 +1,9 @@
+plugins:
+  # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-guest-provider:{{inherit}} once published on quay
+  - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-guest-provider:bs_1.52.0__0.2.20
+    disabled: false
+    pluginConfig:
+      auth:
+        providers:
+          guest:
+            dangerouslyAllowOutsideDevelopment: true

src/deployment/rhdh/config/auth/keycloak/dynamic-plugins.yaml

@@ -1,5 +1,8 @@
+# catalog-backend-module-keycloak and oidc-provider are disabled in default.packages.yaml,
+# so {{inherit}} fails at install. Use explicit overlays tags until these images are on quay.io/rhdh.
 plugins:
-  - package: oci://quay.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak:{{inherit}}
+  # TODO: switch to oci://quay.io/rhdh/backstage-community-plugin-catalog-backend-module-keycloak:{{inherit}} once published on quay
+  - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-community-plugin-catalog-backend-module-keycloak:bs_1.49.4__3.19.2
     disabled: false
     pluginConfig:
       catalog:
@@ -18,3 +21,28 @@ plugins:
                   seconds: 15
                 timeout:
                   minutes: 1
+  # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-oidc-provider:{{inherit}} once published on quay
+  - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-oidc-provider:bs_1.52.0__0.4.17
+    disabled: false
+    pluginConfig:
+      auth:
+        providers:
+          oidc:
+            production:
+              metadataUrl: ${KEYCLOAK_METADATA_URL}
+              clientId: ${KEYCLOAK_CLIENT_ID}
+              clientSecret: ${KEYCLOAK_CLIENT_SECRET}
+              prompt: auto
+              callbackUrl: ${RHDH_BASE_URL}/api/auth/oidc/handler/frame
+              signIn:
+                resolvers:
+                  - resolver: emailLocalPartMatchingUserEntityName
+  # Workspaces using auth: "keycloak" may still call loginAsGuest() (e.g. topology RBAC).
+  # TODO: switch to oci://quay.io/rhdh/backstage-plugin-auth-backend-module-guest-provider:{{inherit}} once published on quay
+  - package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/backstage-plugin-auth-backend-module-guest-provider:bs_1.52.0__0.2.20
+    disabled: false
+    pluginConfig:
+      auth:
+        providers:
+          guest:
+            dangerouslyAllowOutsideDevelopment: true

src/deployment/rhdh/constants.ts

@@ -62,7 +62,10 @@ export const AUTH_CONFIG_PATHS: Record<
       "dist/deployment/rhdh/config/auth/guest/app-config.yaml",
     ),
     secrets: "",
-    dynamicPlugins: "",
+    dynamicPlugins: path.join(
+      PACKAGE_ROOT,
+      "dist/deployment/rhdh/config/auth/guest/dynamic-plugins.yaml",
+    ),
   },
   keycloak: {
     appConfig: path.join(
@@ -87,7 +90,10 @@ export const AUTH_CONFIG_PATHS: Record<
       PACKAGE_ROOT,
       "dist/deployment/rhdh/config/auth/github/secrets.yaml",
     ),
-    dynamicPlugins: "",
+    dynamicPlugins: path.join(
+      PACKAGE_ROOT,
+      "dist/deployment/rhdh/config/auth/github/dynamic-plugins.yaml",
+    ),
     mergeStrategy: { arrayMergeStrategy: { byKey: "target" } },
   },
 };