DEV Community

Keycloak Express Openid-client

Austin Cunningham on February 25, 2022

Keycloak is deprecating their client adapters (keycloak-connect) for Node and recommending openid-client as a replacement. Setup Keycloak...

Read full post

Micaël Félix • Sep 8 '23

Just for information if you follow this but have no render feature installed in express, it will fail with "Cannot GET /testauth" even if it's connected.
Just use res.send('You are connected'); instead of res.render('test'); for the /testauth route.

Kez • May 9 '23

Since Version 0.6.0 of passport the "logout" method is asynchronous. The "logout callback" must therefore be changed to.

// logout callback
app.get('/logout/callback', (req, res, next) => {
    req.logout((err) => {
        if (err) { return next(err) }
        res.redirect('/');
    });      
});

Maybe you can update your tutorial accordingly. (Your article was a great help!)

Kez • Jun 6 '23

While trying to connect a vue application to keycloak using your code I noticed that there seems to be no further communication between keycloak and nodejs after a successful login. Once a session is created the validity of the connection between browser and nodejs is based on the validity of the session cookie alone.
In other words: If I end the session in keycloak by other means (e.g. logout by another client or by admin) then the express application won't notice.
Is this intended or did I make a mistake?
It looks to me like you switch from an oidc authentication to a http-cookie authentication.
Shouldn't there be a check in regular intervalls whether the user is still logged-in in keycloak? Or do you have an idea how this could beachived?

Austin Cunningham • Jun 7 '23

Hmm yea interesting problem, I didn't factor in logging out by keycloak admin or by another client my logic is only triggered when you hit the endpoint in express. Here is another example using bearer which might be better suited to your use case github.com/keycloak/keycloak/discu.... A regular check sounds like the way I would go , I don't believe that express-sessions has an event emitted on session expired. Without digging to much into it I would create another endpoint /check-session and poll it using fetch something like

setInterval(() => {
  fetch('/check-session')
    .then(response => response.json())
    .then(data => {
      // Handle the received data from the server
      console.log(data);
    })
    .catch(error => {
      // Handle any errors that occur during the request
      console.error(error);
    });
}, 5000); // Poll every 5 seconds

I haven't tested it but it should probably work.

Kez • Jun 15 '23 • Edited

Thank you. But I finally decided to go for a different server technology. I never used NodeJS in a production environment before and I was rather shocked as I saw the long "todo list" for doing so. I don't feel inclined to study the 25th "library", "adapter", "plug-in" or whatever is necessary just to store session cookies.
So I came back to my good old PHP/Apache backend using "jumbojett" as on OIDC adapter.
However - I just wanted to let you know that I also rely on http sessions. But what I do to keep the connection to keycloak is: I store the access token in a session variable (in the backend) and with each AJAX request (it's a Vue SPA) I send the access token to keycloak to verify whether the user is still authorized.
So there are actually two sessions running (just like in your example), one in PHP/Apache and one in keycloak. And I need to make sure that the PHP session is at least as long (time-wise) as the keycloak session.
I believe this is something which would work in your example too.

Tatiana Vitorello • May 23 '22

Hey, Austin! Thank you so much for your article, I was able to make it work locally with it! :D

However, I'm facing some issues to run my application on docker. When I try to run both Keycloak and the application on containers, I receive the following error:

Error: connect ECONNREFUSED 127.0.0.1:8080
users-app  |     at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1195:16) {
users-app  |   errno: -111,
users-app  |   code: 'ECONNREFUSED',
users-app  |   syscall: 'connect',
users-app  |   address: '127.0.0.1',
users-app  |   port: 8080
users-app  | }

I'm running keycloak through docker-compose on port 8080 and using http://localhost:8080/auth/realms/my-realm/.well-known/openid-configuration on Issuer.discover. When trying to access this link through the browser, it works normally.

Do you have some hint on what may be causing it? I tried to tie a bridge network between keycloak container and nodejs container and it did not work also.

Austin Cunningham • May 24 '22 • Edited

Thanks for taking the time to try this out in a docker container. So the issue is this line github.com/austincunningham/keyclo... where the localhost is the localhost inside the container and has no visibility on the global localhost (if that makes sense). Some solutions here how-to-connect-to-localhost-within... , I tried

ip addr show docker0

to get the ip address and use that instead of localhost in the code and rebuilt the container

const keycloakIssuer = await Issuer.discover('http://172.17.0.1:8080/realms/keycloak-express')

Looks to be working

docker run -p 3000:3000 quay.io/austincunningham/keycloak-express-openid-client:latest
Discovered issuer http://172.17.0.1:8080/realms/keycloak-express {
  claim_types_supported: [ 'normal' ],
  claims_parameter_supported: true,
  grant_types_supported: [
    'authorization_code',
    'implicit',
    'refresh_token',
    'password',
    'client_credentials',
    'urn:ietf:params:oauth:grant-type:device_code',
    'urn:openid:params:grant-type:ciba'
  ],...

Austin Cunningham • May 25 '22

There has to be a better way to get the docker0 ip address. This will get it

ifconfig | awk '/docker0/{getline; print}' | awk '{ print $2 }'

You can then create an environment variable

export DOCKERHOST=$(ifconfig | awk '/docker0/{getline; print}' | awk '{ print $2 }')

Change the issuer to use the environment variable

const keycloakIssuer = await Issuer.discover("http://"+ process.env.DOCKERHOST +":8080/realms/keycloak-express")

Can pass it in on docker run

docker run -p 3000:3000 -e DOCKERHOST=$DOCKERHOST quay.io/austincunningham/keycloak-express-openid-client:latest

For docker compose you can use a env file to pass in environment variables

Tatiana Vitorello • Jul 5 '22

Hey, Austin! Sorry for taking so long to reply, but I wanted to thank you for your help! It really helped me and worked like a charm! :)

Tatiana Vitorello • May 23 '22

Also, here's how I configured my apps on docker-compose.yml:

Network:

networks:
  app-tier:
    driver: bridge

Keycloak:

keycloak:
    container_name: keycloak
    image: jboss/keycloak:latest
    restart: always
    environment:
      DB_VENDOR: POSTGRES
      DB_ADDR: postgres
      DB_DATABASE: postgres
      DB_USER: postgres
      DB_SCHEMA: public
      DB_PASSWORD: password
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      JDBC_PARAMS: "useSSL=false"
    ports:
      - 8080:8080
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - app-tier

And Node app:

users-app:
    container_name: users-app
    build: 
      context: .
      dockerfile: ./server/users/Dockerfile
    restart: always
    ports:
      - 8880:8880
    environment:
      - DOPPLER_TOKEN
    networks:
      - app-tier

nikunjm10 • Mar 28 '23

Hello Austin,
I was using keycloak-connect till now and it was working fine for me. As this adapter is getting deprecated I will try your solution for open-id client adapter, But I have a few questions regarding it.
Can we do role based and attributed encryption using it?
Can we protect the resources using this adapter?
As you will know that in the keycloak.protect() we can pass the roles and attributes. Also for protecting resources we can use keycloak.enforce().

Also we can pass the configuration to the keycloak using the previous adapter, can we do it with the help of this?

Thanks & Regards
Nikunj Mangla

Austin Cunningham • Mar 29 '23

Hi Nikunj,
Don't get me wrong here I loved keycloak-connect, it offered so much more out of the box that OpenID client does. OpenID client doesn't have this functionally as it is a generic client to be used with any OIDC provider. I am not sure without further investigation weather it is possible to pass roles within the auth flow or weather its possible to do something similar to keycloak.enforce() on resources, as for passing configuration I suspect that this functionality isn't available via OpenID client. These a all good questions It might be worth raising these with the Keycloak team github.com/keycloak/keycloak/discu... around the deprecation of the Node adapter.

Regards,
Austin

Austin Cunningham • Mar 29 '23

Hi Ninkunj,

I was just reading down through the github discussions and looks like roles is possible see github.com/keycloak/keycloak/discu....
Regards,
Austin

nikunjm10 • Mar 29 '23

Hello Austin,

Thank you for replying to my queries. I have also posted my concerns on the github discussion page. I will try with the roles checking through the link you provided. I am trying another module for now which is @keycloak/keycloak-admin-client not sure though if it will work or not for me. Let's see when they are going to provide a good support for the keycloak on nodejs

Mohammad Jawad (Kasir) Barati • Apr 29 '23

Did you manage to do cool stuff like role checking and resource checking with openid-client or any other 3rd party lib. I was trying to achieve the same goal with openid-client but I stuck. Now I am wondering how to check roles, resources, ...

Any update @austincunningham, @nikunjm10 ?

Austin Cunningham • May 4 '23

It was possible to do roles github.com/keycloak/keycloak/discu... there is an example in the discussion. It looks like keycloak-connect will be around for another while github.com/keycloak/keycloak/discu...

pspaulding • Apr 5 '22

When using keycloak-connect, a "kauth" object was available on the request object that included all sorts of useful information, including any custom user attributes that were mapped to the access token (kauth.grant.access_token). What would be the equivalent when using passport/openid?

Austin Cunningham • Apr 6 '22

I haven't used kauth before but can see how it would be useful. I had a look at the request object returned by passport/openid I couldn't see an equivalent to grant.access_token in the request. So as far as I can see there is no equivalent to kauth.grant.access_token.

Ruben Martins • Mar 19 '23

HI Austin! I am new to using keycloak, I am a bit confused on how to integrate this solution with a react application that is also secured by keycloak, can you lead me in the right path :)

Austin Cunningham • Mar 19 '23

This is not something I have done myself but I think this might cover it for you medium.com/devops-dudes/secure-fro...

Ruben Martins • Mar 19 '23

Thanks for your reply, I´m doing most exactly like the article you send me but in this case for backend I´m not using the keycloak node adapter but the Keycloak Express Openid-client that is in your article. Right now I´m getting a valid token in my react app but when I´m sending this token in the headers of my requets and use the function that you created to check authentication I´m still getting that I´m not authenticated.
Do I have to trigger the route /test from the react app to set the req.isAuthenticate to true or I just have to check if the token I send it´s valid ?

Austin Cunningham • Mar 21 '23

Hey Ruben, as I've said its not something I have done so not too sure what advice I should give. I am curious req.isAuthenticated() should check for a valid token . It's something I would like to investigate when I have the time. If I figure it out I will post another blog.

Mohammad Jawad (Kasir) Barati • Apr 29 '23

Hey, look at my repo: github.com/kasir-barati/you-say

I have a NestJS, and react app.

pspaulding • Mar 30 '22

Thank you!

Daniel Kuruch • Mar 2 '23

Hey, Austin ! Thank you for your article. But do you have such solution for Fastify ?

Austin Cunningham • Mar 6 '23

Hi Daniel, I haven't tried Fastify, but is now on my todo list. I will stick a blog up if I get it working.

DavidJLion • Mar 15 '23

Hi Austin. Thanks for your article.
However when I run the application I am getting this error.

Austin Cunningham • Mar 15 '23

Hi David I can reproduce your error with the Keycloak server not running so you may not be running it on the default port

npm start 

> keycloak-express-openid-client@1.0.0 start
> node index.js

node:internal/process/esm_loader:94
    internalBinding('errors').triggerUncaughtException(
                              ^

Error: connect ECONNREFUSED 127.0.0.1:8080
    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1187:16) {
  errno: -111,
  code: 'ECONNREFUSED',
  syscall: 'connect',
  address: '127.0.0.1',
  port: 8080
}
npm notice 
npm notice New major version of npm available! 8.11.0 -> 9.6.1
npm notice Changelog: https://github.com/npm/cli/releases/tag/v9.6.1
npm notice Run npm install -g npm@9.6.1 to update!
npm notice

This makes sense as Keycloak's default port is 8080
Started up the keycloak server and was able to get it running

 npm start          

> keycloak-express-openid-client@1.0.0 start
> node index.js

Discovered issuer http://localhost:8080/realms/keycloak-express {
  claim_types_supported: [ 'normal' ],
  claims_parameter_supported: true,
  grant_types_supported: [
    'authorization_code',
    'implicit',
    'refresh_token',
    'password',
    'client_credentials',
    'urn:ietf:params:oauth:grant-type:device_code',
    'urn:openid:params:grant-type:ciba'
  ],
  ...
  require_pushed_authorization_requests: false,
  pushed_authorization_request_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/ext/par/request',
  mtls_endpoint_aliases: {
    token_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/token',
    revocation_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/revoke',
    introspection_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/token/introspect',
    device_authorization_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/auth/device',
    registration_endpoint: 'http://localhost:8080/realms/keycloak-express/clients-registrations/openid-connect',
    userinfo_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/userinfo',
    pushed_authorization_request_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/ext/par/request',
    backchannel_authentication_endpoint: 'http://localhost:8080/realms/keycloak-express/protocol/openid-connect/ext/ciba/auth'
  }
}
Listening at http://localhost:3000