forked from bcgov/common-hosted-form-service
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Initial commit for moving from Keycloak custom realm to BC Gov standa…
…rd realm Signed-off-by: Jason Sherman <[email protected]>
- Loading branch information
1 parent
89fa641
commit da2e16e
Showing
18 changed files
with
324 additions
and
124 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| const jose = require('jose'); | ||
| const config = require('config'); | ||
| const errorToProblem = require('./errorToProblem'); | ||
|
|
||
| const SERVICE = 'JwtService'; | ||
|
|
||
| const jwksUri = config.get('server.keycloak.jwksUri'); | ||
|
|
||
| // Create a remote JWK set that fetches the JWK set from server with caching | ||
| const JWKS = jose.createRemoteJWKSet(new URL(jwksUri)); | ||
|
|
||
| class JwtService { | ||
| constructor({ issuer, audience, maxTokenAge }) { | ||
| if (!issuer || !audience || !maxTokenAge) { | ||
| throw new Error('JwtService is not configured. Check configuration.'); | ||
| } | ||
|
|
||
| this.audience = audience; | ||
| this.issuer = issuer; | ||
| this.maxTokenAge = maxTokenAge; | ||
| } | ||
|
|
||
| getBearerToken(req) { | ||
| if (req.headers && req.headers.authorization && req.headers.authorization.startsWith('Bearer ')) { | ||
| return req.headers.authorization.substring(7); | ||
| } | ||
| // do we want to throw errors? | ||
| return null; | ||
| } | ||
|
|
||
| async getTokenPayload(req) { | ||
| const bear = this.getBearerToken(req); | ||
| if (bear) { | ||
| return await this._verify(bear); | ||
| } | ||
| return null; | ||
| } | ||
|
|
||
| async _verify(token) { | ||
| // could throw JWTClaimValidationFailed | ||
| const { payload } = await jose.jwtVerify(token, JWKS, { | ||
| issuer: this.issuer, | ||
| audience: this.audience, | ||
| maxTokenAge: parseInt(this.maxTokenAge), | ||
| }); | ||
| return payload; | ||
| } | ||
|
|
||
| async validateAccessToken(token) { | ||
| try { | ||
| await this._verify(token); | ||
| // these claims passed, just return true. | ||
| return true; | ||
| } catch (e) { | ||
| if (e instanceof jose.errors.JWTClaimValidationFailed) { | ||
| return false; | ||
| } else { | ||
| errorToProblem(SERVICE, e); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| protect(spec) { | ||
| // actual middleware | ||
| return async (req, res, next) => { | ||
| // get token, check if valid | ||
| const token = this.getBearerToken(req); | ||
| if (token) { | ||
| const payload = await this._verify(token); | ||
| if (spec && !payload.roles.includes(spec)) { | ||
| // todo: fix logic to prevent access | ||
| next(); | ||
| } | ||
| } | ||
| next(); | ||
| }; | ||
| } | ||
| } | ||
|
|
||
| const audience = config.get('server.keycloak.audience'); | ||
| const issuer = config.get('server.keycloak.issuer'); | ||
| const maxTokenAge = config.get('server.keycloak.maxTokenAge'); | ||
|
|
||
| let jwtService = new JwtService({ | ||
| issuer: issuer, | ||
| audience: audience, | ||
| maxTokenAge: maxTokenAge, | ||
| }); | ||
| module.exports = jwtService; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,3 @@ | ||
| const config = require('config'); | ||
| const Keycloak = require('keycloak-connect'); | ||
|
|
||
| module.exports = new Keycloak( | ||
| {}, | ||
| { | ||
| bearerOnly: true, | ||
| 'confidential-port': 0, | ||
| clientId: config.get('server.keycloak.clientId'), | ||
| 'policy-enforcer': {}, | ||
| realm: config.get('server.keycloak.realm'), | ||
| realmPublicKey: config.has('server.keycloak.publicKey') ? config.get('server.keycloak.publicKey') : undefined, | ||
| secret: config.get('server.keycloak.clientSecret'), | ||
| serverUrl: config.get('server.keycloak.serverUrl'), | ||
| 'ssl-required': 'external', | ||
| 'use-resource-role-mappings': true, | ||
| 'verify-token-audience': false, | ||
| } | ||
| ); | ||
| module.exports = new Keycloak({}, {}); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.