Express Middleware that allows authentication / authorization using Keycloak. It's similar to the official adapter, but it allows the application to work with any keycloak realm.
Uses the official Keycloak Node.js Adapter under the hood.
npm install keycloak-connect keycloak-connect-multirealm
or
yarn add keycloak-connect keycloak-connect-multirealm
Starting from version 1.1.0, keycloak-connect is required as a peer dependency. That way you can update keycloak-connect module independently from this module.
The usage is very similar to the official module:
const express = require('express');
const KeycloakMultirealm = require('keycloak-connect-multirealm');
const app = express();
const config = {};
const keycloakConfig = {
'auth-server-url': 'http://localhost:8080/auth',
'bearer-only': true,
'ssl-required': 'external',
'resource': 'my-node-app',
};
// Instantiate the class just as the official module. If no keycloakConfig
// is provided, it will read the configuration from keycloak.json file.
const keycloak = new KeycloakMultirealm(config, keycloakConfig);
// add the middleware
app.use(keycloak.middleware());
// protect any endpoint
app.get('/files', keycloak.protect(), filesEndpointHandler);As you can see, you don't need to set the realm in your keycloak configuration. Any of the realms will be accepted.
You can see the official documentation for more examples and options.
For requests without token to work (anonymous requests), you must implement the getRealmNameFromRequest method. This is required for admin and logout endpoints to work.
The implementation will depend on your specific use case:
keycloak.getRealmNameFromRequest = (req) => {
// for example, you could get the realmName from the path
return req.originalUrl.split('/')[0];
};
keycloak.getRealmNameFromRequest = (req) => {
// or from the host
return req.get('host').split('.')[0];
};
keycloak.getRealmNameFromRequest = (req) => {
// or from a query string
return req.query.realm;
};
Obviously, for admin endpoints to work, you might need to change the admin URL in the client settings in Keycloak.
If the request contains a valid token, it tries to get the realm name from the token.
If the request doesn't contain a valid token, it tries to get the realm name from the getRealmNameFromRequest method. (Which by default is empty, and should be implemented if needed)
Then, based on the realm name, uses under the hood the official keycloak-connect module.
When found, this middleware adds the realm name to the request: req.kauth.realm.
Tested on bearer-only applications. If getRealmNameFromRequest is properly implemented, it should work for public clients as well, but I haven't tested it.
Copyright 2018, by the NodeJS Team at Devsu
Apache 2.0 License