With Backstage v1.39, this new config has been pulled in that resolves the issue of oversized JWT tokens. Refer to this comment and upstream docs for more detail.

This config is applied like so:

auth:
  omitIdentityTokenOwnershipClaim: true 

Ideally, this information would live under the authentication troubleshooting section. For now, we can add this under the overview section of auth.

HTTP Errors

Request Header Too Large (see bug)

This error can indicate that the user identity token is too long because the user is a part of a lot of groups, causing the ownership claim to grow very large. 

Solution: 

• Set auth.omitIdentityTokenOwnershipClaim to true

Login failed Errors in RHDH Sign-in Page

Login failed; caused by Error: Failed to sign-in, unable to resolve user identity. Please verify that your catalog contains the expected User entities that would match your configured sign-in resolver.

This error indicates that the user that is trying to sign in does not match a user entity in the RHDH catalog. 

Solution: 

• Check that the corresponding catalog provider plugin is set up correctly and is successfully syncing users/groups into the catalog (confirm in backend logs)

It should look like:

backend:start: 2025-06-20T18:52:25.691Z catalog info Read 114 GitHub users and 22 GitHub groups in 3.4 seconds. Committing... target="https://github.com" class="GithubMultiOrgEntityProvider" taskId="GithubMultiOrgEntityProvider:development:refresh" taskInstanceId="a2d0e664-8537-453c-985c-6932ff7d8e88" trace_id="a4f8261b7bdd0c8848150b2ecbf095f0" span_id="32666fa09b7585ba" trace_flags="01"

backend:start: 2025-06-20T18:52:25.715Z catalog info Committed 114 GitHub users and 22 GitHub groups in 0.0 seconds. target="https://github.com" class="GithubMultiOrgEntityProvider" taskId="GithubMultiOrgEntityProvider:development:refresh" taskInstanceId="a2d0e664-8537-453c-985c-6932ff7d8e88" trace_id="a4f8261b7bdd0c8848150b2ecbf095f0" span_id="32666fa09b7585ba" trace_flags="01"

If the users/groups have been ingested into the catalog:

• Check that the resolver used (default or configured) does work to match based on the correct parameters 
• Use the guest log in to look into the user entity in the catalog