bs cfg

infra/values/base/backstage-values.yaml

@@ -10,7 +10,10 @@ global:
   dynamic:
     includes:
     - dynamic-plugins.default.yaml
-    plugins: []
+    plugins:
+    # Keycloak backend catalog module — syncs users & groups into the catalog
+    - package: ./dynamic-plugins/dist/backstage-community-plugin-catalog-backend-module-keycloak-dynamic
+      disabled: false
 
 # Disable OpenShift Route (not on OpenShift)
 route:
@@ -61,12 +64,12 @@ upstream:
               clientId: ${AUTH_OIDC_CLIENT_ID}
               clientSecret: ${AUTH_OIDC_CLIENT_SECRET}
               prompt: auto
-              # Allow login before User entities exist in the catalog.
-              # Remove once org data is populated.
-              dangerouslyAllowSignInWithoutUserInCatalog: true
               signIn:
                 resolvers:
-                - resolver: preferredUsernameMatchingUserEntityName
+                - resolver: emailMatchingUserEntityProfileEmail
+                  # Allow login before User entities exist in the catalog.
+                  # Remove once Keycloak org sync populates User entities.
+                  dangerouslyAllowSignInWithoutUserInCatalog: true
 
       # -- Gitea SCM integration (for catalog URL resolution)
       integrations: