Keycloack OpenId Connect Authorization Code Flow Sample

The sample is an Express.js app that uses Passport.js and the Passport-OpenIdConnect module for managing user authentication.

The sample tries to keep everything as simple as possible so only implements

Login - redirecting users to Keycloack for authentication
Logout - destroying the local session and revoking the token at Keycloak
User Info - fetching profile information from Keycloak
Echo API request - Authenticated call to echo api (UPSTREAM_ENDPOINT)

Setup

In order to run this sample you need to setup an OpenId Connect app in your Keycloak Admin portal.

Configure Red Hat Single Sign-On (keycloak)

To configure RH-SSO, take the following steps:

Create a realm (<REALM_NAME>).
Create a client:
- Specify a client ID.
- In the Client Protocol field, select openid-connect.
- To configure the client permissions, set the following values:
  - Access Type to confidential. (not sure required)
  - Standard Flow Enabled to ON.
  - Add your callback url to the list of approved Valid Redirect URIs . e.g. http://myhost.127.0.0.1.nip.io::3000/oauth/callback
- Note the client credentials:
  - Make a note of the client ID (<CLIENT_ID>).
  - Navigate to the Credentials tab of the client and make a note of the Secret field (<CLIENT_SECRET>).
Add a user to the realm:
- Click the Users menu on the left side of the window.
- Click Add user.
- Type the username, set the Email Verified switch to ON, and click Save.
- On the Credentials tab, set the password. Enter the password in both the fields, set the Temporary switch to OFF to avoid the password reset at the next login, and click Reset Password.
- When the pop-up window displays, click Change password.

Set environment

$ cat .env
OIDC_BASE=https://KEYCLOAK_DOMAIN/auth/realms/eguzki
OIDC_CLIENT_ID=KEYCLOAK_CLIENT_ID
OIDC_CLIENT_SECRET=KEYCLOAK_CLIENT_SECRET
OIDC_REDIRECT_URI=http://localhost:3000/oauth/callback
UPSTREAM_ENDPOINT=https://api-3scale-apicast-production.eguzki.apps.dev-eng-ocp4-5.dev.3sca.net

Allow Authorino to contact self-signed RHSSO (keycloak)

$ echo quit | openssl s_client -showcerts -servername keycloak-eguzki.apps.dev-eng-ocp4-6-operator.dev.3sca.net -connect keycloak-eguzki.apps.dev-eng-ocp4-6-operator.dev.3sca.net:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > dev-eng-ocp4-6.pem

$ kubectl create configmap ca-pemstore-dev-eng-ocp4-6 --from-file=dev-eng-ocp4-6.pem -n kuadrant-system

$ cat tls-deployment-patch.yaml
spec:
  template:
    spec:
      containers:
      - name: manager
        volumeMounts:
        - name: ca-pemstore-dev-eng-ocp4-6
          mountPath: /etc/ssl/certs/dev-eng-ocp4-6.pem
          subPath: dev-eng-ocp4-6.pem
          readOnly: false
      volumes:
      - name: ca-pemstore-dev-eng-ocp4-6
        configMap:
          name: ca-pemstore-dev-eng-ocp4-6

$ kubectl patch deployment authorino-controller-manager --type=strategic --patch "$(cat tls-deployment-patch.yaml)" -n kuadrant-system

Run

This sample uses an express app running on nodejs.

From the command line run

> npm install
> npm start

Local testing

By default these samples will run on http://myhost.127.0.0.1.nip.io::3000.