passport-keycloak-bearer

import express from 'express'; import passport from 'passport'; import KeycloakBearerStrategy from 'passport-keycloak-bearer'; const app = express(); // --- IMPORTANT: Replace with your actual Keycloak configuration --- const KEYCLOAK_URL = process.env.KEYCLOAK_AUTH_URL ?? 'https://your-keycloak-instance.com/auth'; const KEYCLOAK_REALM = process.env.KEYCLOAK_REALM ?? 'your-realm'; // ------------------------------------------------------------------ passport.use(new KeycloakBearerStrategy({ url: KEYCLOAK_URL, realm: KEYCLOAK_REALM, passReqToCallback: false // Set to true if your verify callback needs the request object }, (jwtPayload, done) => { // In a real application, you would fetch user details from a DB // or create a user object based on the JWT payload (e.g., jwtPayload.sub) const user = { id: jwtPayload.sub, username: jwtPayload.preferred_username, roles: jwtPayload.realm_access?.roles }; // Example: only allow users with 'api-user' role if (user.roles && user.roles.includes('api-user')) { return done(null, user); // User authenticated successfully } else { return done(null, false, { message: 'User does not have required roles.' }); // Authentication failed } })); app.use(passport.initialize()); // A protected route app.get('/api/protected', passport.authenticate('keycloak-bearer', { session: false }), (req, res) => { // req.user will contain the user object returned from the verify callback res.json({ message: 'Access granted!', user: req.user }); }); // Public route app.get('/api/public', (req, res) => { res.json({ message: 'This is a public endpoint.' }); }); const PORT = process.env.PORT || 3000; app.listen(PORT, () => { console.log(`Server running on http://localhost:${PORT}`); console.log(`Test with curl -H "Authorization: Bearer <YOUR_KEYCLOAK_JWT_TOKEN>" http://localhost:${PORT}/api/protected`); });