6:33 p.m.
Need to share some context and setup before asking my question, so please
excuse the wall of text. =)
My app:
`frontend` is a SPA served as a static resource from NGINX (http://frontend)
`keycloak` server running on http://keycloak
`middleware` is a NodeJS app that frontend communicates with as API
endpoint (eg: http://middleware). Middleware is using
keycloak-nodejs-connect (https://github.com/keycloak/keycloak-nodejs-connect)
to protect the API endpoint
setup code in middleware looks like this:
```
const session = require('express-session')
const memoryStore = new session.MemoryStore()
app.use(session({
secret: 'mySecret',
resave: false,
saveUninitialized: true,
store: memoryStore
}))
const keycloak = require('./auth/keycloak')
app.use(keycloak.middleware({
logout: '/logout'
}))
```
The setup in auth/keycloak.js is:
```
const keycloakConfig = {
'realm': 'realmName',
'auth-server-url': `http://keycloak/auth`,
'ssl-required': 'external',
'resource': 'clientName',
'credentials': {
'secret': 'aaaaaaaa-bbbb-cccc-dddd-1a49c9dfbbef'
}
}
module.exports = new Keycloak({store: memoryStore, responseType: 'code'},
keycloakConfig)
```
when a user clicks "/login" link from frontend, the frontend spawns a new
tab and the new tab calls http://middleware/login. The motivation is for
the existing state in UI to not be touched, all redirects etc happen in a
new window. The code in middleware looks like this:
```
app.get('/login', keycloak.protect(), (req, res) => {
const keycloakTokens = JSON.parse(req.session['keycloak-token'])
const userInfo = JSON.stringify(decodeToken(keycloakTokens))
res.status(200).send(`<html><head>
<script type="text/javascript">
window.opener.postMessage(${userInfo}, 'http://frontend')
window.close()
</script>
</head></html>`)
})
const decodeToken = ({id_token}) => {
const payload = JSON.parse(atob(id_token.split('.')[1]))
return payload
}
```
So the idea is that after the OIDC dance, the middleware will respond
asking the new tab to postMessage to the opener (parent) with the contents
of the id_token JWT.
Assumption 1: the session in the cookie connect.sid is what the middleware
uses to ensure the user is still authenticated. Is this assumption accurate?
there is a event listener in frontend that watches for the `postMessage`
and saves the information sent (id_token) to localStorage.
Question 1: is this a correct way of doing login given the setup described
above?
I think i'm definitely missing something because another protected route in
middleware causes redirect to keycloak again telling me that middleware
does not know the frontend is authenticated.
Question 2: how would logout work in this case? just clear the browser
cookies?
I tried the example app (
https://github.com/keycloak/keycloak-nodejs-connect/tree/master/example)
but that has a different architecture, the browser points to the middleware
domain.
please let me know if you are looking for more code snippets or details.
Happy to provide.
Regards,
Rudy.
2415
days inactive
2415
days old
0 comments
1 participants
participants (1)
-
Rudresh Shashikant