keycloak / keycloak/keycloak-nodejs-connect

Proposal: use `jose` package as alternative to `keycloak-nodejs-connect`

Open
#492 20 comments 7 reactions 0 assignees View on GitHub
kind/enhancement status/triage
Dominant language
JavaScript
Stars
740
Forks
442
PR merge metrics
No merged PRs in 30d

Description

### Description

Since this library is deprecated I would like to propose one of the possible alternatives => [jose](https://github.com/panva/jose)
It contains quite useful functions: `createRemoteJWKSet` and `jwtVerify` as described here: https://github.com/panva/jose/blob/main/docs/functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset

Example verification with jose looks like this:
```ts
import { JWTPayload, createRemoteJWKSet, jwtVerify } from "jose";

const auth_server_url = "http://keycloak.localhost:8080";
const jwks = createRemoteJWKSet(new URL(`${auth_server_url}/realms/${realmName}/protocol/openid-connect/certs`));
const { payload } = await jwtVerify(token, jwks); // this line will throw on invalid token
console.log(payload.sub);
```

`jose` automatically fetches public keys from endpoint if previous ones are not valid.
> The JSON Web Key Set is fetched when no key matches the selection process

`Jose` library seems to cover significant part of `keycloak-nodejs-connect` functionality. I already using it in my app and DX is even more enjoyable. I have more control and can create express middleware myself, or integrate it in any kind of app bcs it is not tightly coupled to `expressjs`.

@jonkoops @abstractj I would really appreciate your review about using `jose`, seems like it can be recommended as `keycloak-nodejs-connect` alternative or at least one of alternatives. In any case would be very helpful to hear your thoughts on it, whether you think it is good replacement or not. Tagging both of you since you guys seem to be active ones in this repo from maintainers.

Btw, also, as I checked another library named `jose` is used under the hood in keycloak Java source code too.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the proposal and the linked jose documentation for createRemoteJWKSet and jwtVerify, then compare them with the functionality provided by keycloak-nodejs-connect. The work is complete when maintainers decide whether jose is a suitable recommended alternative and define the integration scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
authentication, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.