keycloak / keycloak/keycloak-nodejs-connect

Allow multiple auth-server-urls

Open
#480 1 comment 4 reactions 0 assignees View on GitHub
kind/enhancement status/triage
Dominant language
JavaScript
Stars
740
Forks
442
PR merge metrics
No merged PRs in 30d

Description

### Description

When using CNAMEs to point to the Keyclaok server, the JWT created has in the `iss` field the CNAME. As the KC Server can be react over both addresses, the `auth-server-url` field of the Config must take this into account. In the code line https://github.com/keycloak/keycloak-nodejs-connect/blob/dd1c20f0c1e6366e98434128eafea2e78ab545fd/middleware/auth-utils/grant-manager.js#L427 the request will be rejected if they come form the CNAME URL of the URL the CNAME Points to.

**Proposal**
Type for backwards compatibility:
```js
type auth_server_url_type: string | string[]
````

Usgage:
```js
let iss = new URL(token.content.iss)
if ((typeof this.config.realmUrl) === "string") {
// Use like until now
} else if (Array.isArray(this.config.realmUrl) {
if (this.config.realmUrl.includes(iss.host) && (iss.pathname === ''/realms/' + this.config.realm) // Accept/Reject
} else {
// Error (the Config class constructor should check this)
}
```

### Discussion

_No response_

### Motivation

_No response_

### Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with middleware/auth-utils/grant-manager.js at the linked validation line, then trace the Config class constructor mentioned in the proposal. Check how auth-server-url and realmUrl are currently represented and validated, and confirm that completion preserves string behavior while accepting the proposed multiple URLs for matching token issuers.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.