keycloak / keycloak/keycloak-nodejs-connect

KeyCloakConfig does not allow to configure trust for key fetching

Open
#514 1 comment 1 reaction 0 assignees View on GitHub
kind/bug status/triage
Dominant language
JavaScript
Stars
740
Forks
442
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug

We need to define CA trust for our adapter when it fetches new public keys. Currently this is possible in an arcane way using environment variables but requires detailed knowledge on how to do that.

A natural way to configure that would be with some sort of “ca:” property in KeyCloakConfig.

### Version

15.0.2-redhat-00001

### Expected behavior

It should be easy to supply trust for key fetch requests.

### Actual behavior

We are using NODE_EXTRA_CA_CERTS instead. It is suboptimal and creates a few problems when running CI/CD and when the node process should have different trust roots for different endpoints.

### How to Reproduce?

_No response_

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at KeyCloakConfig and trace how key-fetch requests currently obtain trust, including the NODE_EXTRA_CA_CERTS path. Define how a CA setting should be supplied through the configuration and verify that it supports different trust roots without relying on a global environment variable.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.