Securing Backstage Plugins Using the Permissions Framework
summary
Shows how Backstage permissions provide fine-grained control by walking through three concrete steps: createPermission, call authorized or authorizedConditional on the permissions API, and add unit tests. Explains three permission types (action, resource, conditional), the condition rule API with apply/toQuery and transformConditions, and frontend helpers like the usePermission hook and required-permission tag. Notes real-world constraints: permissions aren’t enabled by default, only ~6–7 plugins use them, and teams must balance granularity, testability, performance, policy mapping and auditability.
AI-written summary · about
chapters (9)
- 0:00Introduction to backstage
- 1:35The permissions API workflow
- 3:37Implementing permissions
- 5:56Conditional permissions
- 10:12Securing the frontend
- 11:55When to use authorization
- 15:16Managing permission complexity
- 16:51Best practices for developers
- 19:16Working with integrators
related talks
26mCan It Be Done? Building Fine-Grained Access Control for Back...
14mBuilding Permissions into Data Modeling
22mREST Easy — API Security Done Right
19mCentralized Compliance: Automated Governance Inside of Backstage...
51mAuthorization beyond @RolesAllowed
21mAuthorised is Not a Yes/No Question
31mAuthorised is Not a Yes No Question
09mFlexible Authorization:Storing and Managing Rules in DB