Keycloak Passport Strategy - oAuth2/OIDC

This library offers a production-ready and maintained Keycloak Passport connector that offers the following key features:

• Use multiple realms in the same application (multi-tenancy)

• Use with oAuth2/Open ID Connect 'clients' in keycloak

• Fetch users' data from keycloak automatically via the JSON API

Listed Keycloak Extension

Check it out on keycloak.org

Why? Hasn't this already been done?

To a certain extent, yes. There are about 3 to 4 repos that brand themselves as 'Keycloak Passport', yet not a single one of them is actively maintained and most of them are either completely empty, don't allow using multiple realms, only implement part of the protocol, and/or don't fetch the user's data from Keycloak. There also exists a dedicated NodeJS connector by the Keycloak project itself, however, it is unusable if you are seeking to have Keycloak as 'yet another' passport strategy in your app. This project fills that gap.

Usage

Install

1npm install @exlinc/keycloak-passport

Import

1import KeycloakStrategy from "@exlinc/keycloak-passport";

Initialize

1// Register the strategy with passport
2passport.use(
3  "keycloak",
4  new KeycloakStrategy(
5    {
6      host: process.env.KEYCLOAK_HOST,
7      realm: process.env.KEYCLOAK_REALM,
8      clientID: process.env.KEYCLOAK_CLIENT_ID,
9      clientSecret: process.env.KEYCLOAK_CLIENT_SECRET,
10      callbackURL: `/api${AUTH_KEYCLOAK_CALLBACK}`
11    },
12    (accessToken, refreshToken, profile, done) => {
13      // This is called after a successful authentication has been completed
14      // Here's a sample of what you can then do, i.e., write the user to your DB
15      User.findOrCreate({ email: profile.email }, (err, user) => {
16        assert.ifError(err);
17        user.keycloakId = profile.keycloakId;
18        user.imageUrl = profile.avatar;
19        user.name = profile.name;
20        user.save((err, savedUser) => done(err, savedUser));
21      });
22    }
23  )
24);

Routes

1router.get(
2  routes.AUTH_KEYCLOAK,
3  passport.authenticate("keycloak", DEFAULT_PASSPORT_OPTIONS)
4);
5router.get(
6  routes.AUTH_KEYCLOAK_CALLBACK,
7  passport.authenticate("keycloak", DEFAULT_PASSPORT_OPTIONS),
8  AuthController.keyCloakSuccess
9);

Compatability with next-auth

There are some known issues with using this passportjs strategy with the latest versions of next-auth. Follow the discussion here.

Contributing/feedback

All forms of contribution are welcome via Issues and Pull-requests to this repo