This repository is an implementation of an HTTP DCR bridge to enable Dynamic Client Registration integration between the Konnect Dev Portal and Keycloak. The HTTP DCR bridge acts as a proxy and translation layer between Keycloak and DCR applications made in the Konnect Dev Portal.
This repository is forked from https://github.com/Kong/konnect-portal-dcr-handler. Please read the README.md of this repo.
The HTTP DCR bridge is deployed as a serverless solution on AWS Lambda and it's based on a lightweight fastify Node.js server.
Do a git clone of this repository
Install Yarn ^1.22.x
-
Create an
Initial Access Token
for managing (from Konnect Dev Portal) the Application creation and store the Initial AT -
Create a
client
, called it for instancekong-sa
, for managing (from Konnect Dev Portal) the application deletion and the refresh token action. The properties are:
- Client Protocol =
openid-connect
- Access Type =
confidential
- Service Accounts =
Enabled
- OAuth 2.0 Device Authorization Grant =
Enabled
- Valid Redirect URIs =
http//*
andhttps://*
Click on Save
- Open the
kong-sa
client, selectService Account Roles
tab, select inClient Roles
therealm-management
and assign roles:
- Create the Function
- Connect to the AWS Console
- Select the proper region (for instance
eu-central-1
) - Create a Lambda function with:
- name =
konnect-portal-dcr-keycloak
- runtime =
Node.js 20.x
- Advanced settings / Enable function URL =
enabled
- name =
Click on Create function
- Open the Function
- Change
Code
/Runtime settings
: handler =lambda.handler
- Change
Configuration
/General configuration
: timeout =10s
- Open
Configuration
/Environment variables
and Edit:- KEYCLOAK_CLIENT_ID =
kong-sa
- KEYCLOAK_CLIENT_SECRET =
<kong-sa-client_secret-to-be-replaced>
- KEYCLOAK_CR_INITIAL_AT =
<initial_at-to-be-replaced>
(see step#1 - Keycloak configuration) - KEYCLOAK_DOMAIN =
<keycloak-domain-to-be-replaced>
(example: https://sso.apim.eu:8443/auth/realms/Jerome/)
- KEYCLOAK_CLIENT_ID =
Click on Save
See the Function URL (here: https://3w7r6pdhh6rgn7iia7sqotrdxm0hrspz.lambda-url.eu-west-3.on.aws/)
- Have a Kong Konnect account
- You can Start a Free trial at: konghq.com
- Login to konnect
- Select Dev Portal / Settings / Application Setup menu and configure with:
- External identity provider for applications =
HTTP
- Issuer =
<keycloak-domain-to-be-replaced>
- HTTP Base URL =
<AWS_Function_url-to-be-replaced>
- Scopes =
openid
- Consumer claims =
clientId
- Auth methods = check
Bearer Access Token
andClient Credentials Grant
- DCR Token = click on
Generate Token
and store the DCR token
- Open the Function
- Open
Configuration
/Environment variables
and Edit:- KONG_API_TOKENS =
<DCR_token-to-be-replaced>
(see step#3 - Konnect Dev Portal configuration)
- KONG_API_TOKENS =
Click on Save
- Create a S3 bucket and call it for instance
konnect-portal-dcr-keycloak
- The purpose of this bucket is to store the source code of the DCR Handler and to push it in the AWS Lambda Function
- You don't need to upload the
ambda-dcr-http.zip
manually: it will be done automatically by the CI workfow
Install dependencies
yarn install --frozen-lockfile
Update the .env
file as explained for Lambda Function
Start local instance
yarn start
The fastify server is started by default on port 3000
- Create a new Application
- Request:
<DCR_token-to-be-replaced>
,<portal_id-to-be-replaced>
,<organization_id-to-be-replaced>
have to be replaced by their proper value. Go on Konnect / Dev Portal to getportal_id
andorganization_id
http POST :3000/ redirect_uris=http://localhost \
x-api-key:<DCR_token-to-be-replaced> \
client_name=jegvscode1 \
application_description=\
grant_types\[\]=authorization_code \
grant_types\[\]=refresh_token \
grant_types\[\]=implicit \
token_endpoint_auth_method=client_secret_jwt \
portal_id=<portal_id-to-be-replaced> \
organization_id=<organization_id-to-be-replaced>
- Response:
HTTP/1.1 201 Created
...
{
"client_id": "f54b9dc4-ee16-4a99-bfc9-4107ae73d6a4",
"client_id_issued_at": 1705399806,
"client_secret": "istHTAPMMFLRDPT83dPfDCHOZH7cLV6V",
"client_secret_expires_at": 0
}
Check on Keycloak the creation of this new client
- Refresh a
client_secret
of an Application
- Request:
http POST :3000/f54b9dc4-ee16-4a99-bfc9-4107ae73d6a4/new-secret x-api-key:<DCR_token-to-be-replaced>
- Response:
HTTP/1.1 200 OK
...
{
"client_id": "f54b9dc4-ee16-4a99-bfc9-4107ae73d6a4",
"client_secret": "JJrUI01URnL863GRyTIIsdFeTrkDVbMj"
}
Check on Keycloak the value of the new client_secret
- Delete an Application
- Request:
http DELETE :3000/f54b9dc4-ee16-4a99-bfc9-4107ae73d6a4 x-api-key:<DCR_token-to-be-replaced>
- Response:
HTTP/1.1 204 No Content
Check on Keycloak the deletion of this client
- The Git Workflow ci.yml pushes the DCR Handler code in the Lambda Function.
- Prepare and start a
self-hosted
Github Runner: open with the browser your Github repo and select Settings / Actions / Runners and click onNew self-hosted runner
- Create Environment secrets: select Settings / Secrets and variables / Environment secrets with:
- Connect to AWS cli (for the
self-hosted
runner)
aws sso login
- Do a Commit & Push of your repo, check in GitHub the green status of your CI workflow
- Login to Konnect Dev Portal
- Click on
My Apps
under your profile name - Click on
New App
- Click on
Create
- Go on Keycloak and check the new Client
- Go on Catalog, Select a Service and Register it to the new App
- Test access
- Request:
http -a 1d2d6ea6-b409-4583-a0f1-8413d8603359:pW1qkzutE6czuO78oTL2GRSkEq8HL05l :8000/myhttpbin/anything
- Response:
HTTP/1.1 200 OK
...
{
"args": {},
"data": "",
"files": {},
"form": {},
"headers": {
"Accept": "*/*",
"Authorization": "Bearer ABCDEF...."
},
"json": null,
"method": "GET",
"url": "https://localhost/anything"
}
- Test the Refresh secret