Fix permissions API to return 401 instead of 500 when IdentityApi.getIdentity throws an error

Signed-off-by: huansong.tang <huansong.tang@grabtaxi.com>

.changeset/early-hornets-pay.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-node': minor
+---
+
+Ensure `getIdentity` throws an `AuthenticationError` instead of a `NotAllowed` error when authentication fails

plugins/auth-node/src/DefaultIdentityClient.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { AuthenticationError, NotAllowedError } from '@backstage/errors';
+import { AuthenticationError } from '@backstage/errors';
 import {
   createRemoteJWKSet,
   decodeJwt,
@@ -86,7 +86,7 @@ export class DefaultIdentityClient implements IdentityApi {
         getBearerTokenFromAuthorizationHeader(request.headers.authorization),
       );
     } catch (e) {
-      throw new NotAllowedError(e.message);
+      throw new AuthenticationError(e.message);
     }
   }