keycloak / keycloak/keycloak-nodejs-connect
Allow multiple auth-server-urls
- Dominant language
- JavaScript
- Stars
- 740
- Forks
- 442
- PR merge metrics
- No merged PRs in 30d
Description
### Description
When using CNAMEs to point to the Keyclaok server, the JWT created has in the `iss` field the CNAME. As the KC Server can be react over both addresses, the `auth-server-url` field of the Config must take this into account. In the code line https://github.com/keycloak/keycloak-nodejs-connect/blob/dd1c20f0c1e6366e98434128eafea2e78ab545fd/middleware/auth-utils/grant-manager.js#L427 the request will be rejected if they come form the CNAME URL of the URL the CNAME Points to.
**Proposal**
Type for backwards compatibility:
```js
type auth_server_url_type: string | string[]
````
Usgage:
```js
let iss = new URL(token.content.iss)
if ((typeof this.config.realmUrl) === "string") {
// Use like until now
} else if (Array.isArray(this.config.realmUrl) {
if (this.config.realmUrl.includes(iss.host) && (iss.pathname === ''/realms/' + this.config.realm) // Accept/Reject
} else {
// Error (the Config class constructor should check this)
}
```
### Discussion
_No response_
### Motivation
_No response_
### Details
_No response_
Contributor guide
Research direction
Start with middleware/auth-utils/grant-manager.js at the linked validation line, then trace the Config class constructor mentioned in the proposal. Check how auth-server-url and realmUrl are currently represented and validated, and confirm that completion preserves string behavior while accepting the proposed multiple URLs for matching token issuers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100