Package Exports

keycloak-connect-multirealm

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (keycloak-connect-multirealm) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

Keycloak Node.js Adapter With Support for multiple realms

Express Middleware that allows authentication / authorization using Keycloak. It's similar to the official adapter, but it allows the application to work with any keycloak realm.

Uses the official Keycloak Node.js Adapter under the hood.

Usage

The usage is very similar to the official module:

const express = require('express');
const KeycloakMultirealm = require('keycloak-connect-multirealm');

const app = express();

const config = {};

keycloakConfig = {
  'auth-server-url': 'http://localhost:8080/auth',
  'bearer-only': true,
  'ssl-required': 'external',
  'resource': 'my-node-app',
};

// Instantiate the class just as the official module. If no keycloakConfig
// is provided, it will read the configuration from keycloak.json file.

const keycloak = new KeycloakMultirealm(config, keycloakConfig);

// add the middleware

app.use(keycloak.middleware());

// protect any endpoint

app.get('/files', keycloak.protect(), filesEndpointHandler);

As you can see, you don't need to set the realm in your keycloak configuration. Any of the realms will be accepted.

You can see the official documentation for more examples and options.

Implementing getRealmNameFromRequest

For requests without token to work (anonymous requests), you must implement the getRealmNameFromRequest method. This is required for admin and logout endpoints to work.

The implementation will depend on your specific use case:

keycloak.getRealmNameFromRequest = (req) => {
  // for example, you could get the realmName from the path
  return req.originalUrl.split('/')[0];
};

keycloak.getRealmNameFromRequest = (req) => {
  // or from the host
  return req.get('host').split('.')[0];
};

keycloak.getRealmNameFromRequest = (req) => {
  // or from a query string
  return req.query.realm;
};

Obviously, for admin endpoints to work, you might need to change the admin URL in the client settings in Keycloak.

How it works

If the request contains a valid token, it tries to get the realm name from the token. If the request doesn't contain a valid token, it tries to get the realm name from the getRealmNameFromRequest method. (Which by default is empty, and should be implemented if needed)

Then, based on the realm name, uses under the hood the official keycloak-connect module.

When found, this middleware adds the realm name to the request: req.kauth.realm.

Status

Tested on bearer-only applications. If getRealmNameFromRequest is properly implemented, it should work for public clients as well, but I haven't tested it.

License and Credits

Apache 2.0 License