Feature Request: Use users credentials for secret action

[tfhartmann]

I would loose my mind with joy if this plugin could be configured to use the users credentials when backstage is using google auth. A flag on the config that could be flipped from "service account" to "user credentials"

I'd really like to allow users to create secrets in projects they have access to without having to give the backstage service account access to those projects directly.

[tdabasinskas]

Hi @tfhartmann,

That sounds like a good idea, but I'm afraid it's a bit challenging to implement.

As per backstage/backstage#9168, currently, retrieving the user token is only supported by a limited number of SCM providers and only a RepoPicker field. Being able to do that here, means we should probably have the following:

• New custom field or field extension, that would allow indicating that the current user token should be passed to the scaffolder plugin.
• Our plugin should be able updated to get this token.
• I'm not sure if we can authenticate to GCP just with the token. We might be able to impersonate the user using his token, but that would likely require additional IAM permissions for the Backstage service account.