keycloak / keycloak/keycloak-nodejs-connect
Proposal: use `jose` package as alternative to `keycloak-nodejs-connect`
- Dominant language
- JavaScript
- Stars
- 740
- Forks
- 442
- PR merge metrics
- No merged PRs in 30d
Description
### Description
Since this library is deprecated I would like to propose one of the possible alternatives => [jose](https://github.com/panva/jose)
It contains quite useful functions: `createRemoteJWKSet` and `jwtVerify` as described here: https://github.com/panva/jose/blob/main/docs/functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset
Example verification with jose looks like this:
```ts
import { JWTPayload, createRemoteJWKSet, jwtVerify } from "jose";
const auth_server_url = "http://keycloak.localhost:8080";
const jwks = createRemoteJWKSet(new URL(`${auth_server_url}/realms/${realmName}/protocol/openid-connect/certs`));
const { payload } = await jwtVerify(token, jwks); // this line will throw on invalid token
console.log(payload.sub);
```
`jose` automatically fetches public keys from endpoint if previous ones are not valid.
> The JSON Web Key Set is fetched when no key matches the selection process
`Jose` library seems to cover significant part of `keycloak-nodejs-connect` functionality. I already using it in my app and DX is even more enjoyable. I have more control and can create express middleware myself, or integrate it in any kind of app bcs it is not tightly coupled to `expressjs`.
@jonkoops @abstractj I would really appreciate your review about using `jose`, seems like it can be recommended as `keycloak-nodejs-connect` alternative or at least one of alternatives. In any case would be very helpful to hear your thoughts on it, whether you think it is good replacement or not. Tagging both of you since you guys seem to be active ones in this repo from maintainers.
Btw, also, as I checked another library named `jose` is used under the hood in keycloak Java source code too.
Contributor guide
Research direction
Start by reviewing the proposal and the linked jose documentation for createRemoteJWKSet and jwtVerify, then compare them with the functionality provided by keycloak-nodejs-connect. The work is complete when maintainers decide whether jose is a suitable recommended alternative and define the integration scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100