1
0
mirror of https://github.com/Unleash/unleash.git synced 2024-10-18 20:09:08 +02:00
unleash.unleash/examples/keycloak-auth-hook.js
2020-02-20 08:34:24 +01:00

92 lines
2.7 KiB
JavaScript

'use strict';
/**
* Keycloak hook for securing an Unleash server
*
* This example assumes that all users authenticating via
* keycloak should have access. You would probably limit access
* to users you trust.
*
* The implementation assumes the following environment variables:
*
* - AUTH_HOST
* - AUTH_REALM
* - AUTH_CLIENT_ID
*/
// const { User, AuthenticationRequired } = require('unleash-server');
const { User, AuthenticationRequired } = require('../lib/server-impl.js');
const KeycloakStrategy = require('@exlinc/keycloak-passport');
const passport = require('passport');
const host = `http://${process.env.AUTH_HOST}`;
const realm = process.env.AUTH_REALM;
const clientId = process.env.AUTH_CLIENT_ID;
const contextPath = process.env.CONTEXT_PATH;
passport.use(
'keycloak',
new KeycloakStrategy(
{
host,
realm,
clientId,
clientSecret: "We don't need that, but is required",
callbackURL: `${contextPath}/api/auth/callback`,
authorizationURL: `${host}/auth/realms/hamis/protocol/openid-connect/auth`,
tokenURL: `${host}/auth/realms/hamis/protocol/openid-connect/token`,
userInfoURL: `${host}/auth/realms/hamis/protocol/openid-connect/userinfo`,
},
(accessToken, refreshToken, profile, done) => {
done(
null,
new User({
name: profile.fullName,
email: profile.email,
})
);
}
)
);
function enableKeycloakOauth(app) {
app.use(passport.initialize());
app.use(passport.session());
passport.serializeUser((user, done) => done(null, user));
passport.deserializeUser((user, done) => done(null, user));
app.get('/api/admin/login', passport.authenticate('keycloak'));
app.get(
'/api/auth/callback',
passport.authenticate('keycloak'),
(req, res) => {
res.redirect(`${contextPath}/`);
}
);
app.use('/api/admin/', (req, res, next) => {
if (req.user) {
next();
} else {
// Instruct unleash-frontend to pop-up auth dialog
return res
.status('401')
.json(
new AuthenticationRequired({
path: `${contextPath}/api/admin/login`,
type: 'custom',
message: `You have to identify yourself in order to use Unleash.
Click the button and follow the instructions.`,
})
)
.end();
}
});
}
module.exports = enableKeycloakOauth;