keycloak-connect-multirealm

Keycloak NodeJS Multi Realm Adapter

Showing:

Popularity

Downloads/wk

646

GitHub Stars

27

Maintenance

Last Commit

4mos ago

Contributors

4

Package

Dependencies

3

Size (min+gzip)

15.7KB

License

Apache-2.0

Type Definitions

Tree-Shakeable

No?

Categories

Readme

Keycloak Node.js Adapter With Support for multiple realms

Express Middleware that allows authentication / authorization using Keycloak. It's similar to the official adapter, but it allows the application to work with any keycloak realm.

Uses the official Keycloak Node.js Adapter under the hood.

Installation

npm install keycloak-connect keycloak-connect-multirealm

or

yarn add keycloak-connect keycloak-connect-multirealm

Starting from version 1.1.0, keycloak-connect is required as a peer dependency. That way you can update keycloak-connect module independently from this module.

Usage

The usage is very similar to the official module:


const express = require('express');
const KeycloakMultirealm = require('keycloak-connect-multirealm');

const app = express();

const config = {};

const keycloakConfig = {
  'auth-server-url': 'http://localhost:8080/auth',
  'bearer-only': true,
  'ssl-required': 'external',
  'resource': 'my-node-app',
};

// Instantiate the class just as the official module. If no keycloakConfig
// is provided, it will read the configuration from keycloak.json file.

const keycloak = new KeycloakMultirealm(config, keycloakConfig);

// add the middleware

app.use(keycloak.middleware());

// protect any endpoint

app.get('/files', keycloak.protect(), filesEndpointHandler);

As you can see, you don't need to set the realm in your keycloak configuration. Any of the realms will be accepted.

You can see the official documentation for more examples and options.

Implementing getRealmNameFromRequest

For requests without token to work (anonymous requests), you must implement the getRealmNameFromRequest method. This is required for admin and logout endpoints to work.

The implementation will depend on your specific use case:

keycloak.getRealmNameFromRequest = (req) => {
  // for example, you could get the realmName from the path
  return req.originalUrl.split('/')[0];
};

keycloak.getRealmNameFromRequest = (req) => {
  // or from the host
  return req.get('host').split('.')[0];
};

keycloak.getRealmNameFromRequest = (req) => {
  // or from a query string
  return req.query.realm;
};

Obviously, for admin endpoints to work, you might need to change the admin URL in the client settings in Keycloak.

How it works

If the request contains a valid token, it tries to get the realm name from the token. If the request doesn't contain a valid token, it tries to get the realm name from the getRealmNameFromRequest method. (Which by default is empty, and should be implemented if needed)

Then, based on the realm name, uses under the hood the official keycloak-connect module.

When found, this middleware adds the realm name to the request: req.kauth.realm.

Status

Tested on bearer-only applications. If getRealmNameFromRequest is properly implemented, it should work for public clients as well, but I haven't tested it.

License and Credits

Copyright 2018, by the NodeJS Team at Devsu

Apache 2.0 License

Rate & Review

Great Documentation0
Easy to Use0
Performant0
Highly Customizable0
Bleeding Edge0
Responsive Maintainers0
Poor Documentation0
Hard to Use0
Slow0
Buggy0
Abandoned0
Unwelcoming Community0
100
No reviews found
Be the first to rate

Alternatives

No alternatives found

Tutorials

No tutorials found
Add a tutorial