Find file Copy path
eaa3859 Sep 7, 2018
1 contributor

Users who have contributed to this file

83 lines (61 sloc) 2.62 KB

Keycloak Passport Strategy - oAuth2/OIDC

This library offers a production-ready and maintained Keycloak Passport connector that offers the following key features:

  • Use multiple realms in the same application (multi-tenancy)

  • Use with oAuth2/Open ID Connect 'clients' in keycloak

  • Fetch users' data from keycloak automatically via the JSON API

Listed Keycloak Extension

Check it out on

Why? Hasn't this already been done?

To a certain extent, yes. There are about 3 to 4 repos that brand themselves as 'Keycloak Passport', yet not a single one of them is actively maintained and most of them are either completely empty, don't allow using multiple realms, only implement part of the protocol, and/or don't fetch the user's data from Keycloak. There also exists a dedicated NodeJS connector by the Keycloak project itself, however, it is unusable if you are seeking to have Keycloak as 'yet another' passport strategy in your app. This project fills that gap.



npm install @exlinc/keycloak-passport


import KeycloakStrategy from "@exlinc/keycloak-passport";


// Register the strategy with passport
  new KeycloakStrategy(
      host: process.env.KEYCLOAK_HOST,
      realm: process.env.KEYCLOAK_REALM,
      clientID: process.env.KEYCLOAK_CLIENT_ID,
      clientSecret: process.env.KEYCLOAK_CLIENT_SECRET,
      callbackURL: `/api${AUTH_KEYCLOAK_CALLBACK}`
    (accessToken, refreshToken, profile, done) => {
      // This is called after a successful authentication has been completed
      // Here's a sample of what you can then do, i.e., write the user to your DB
      User.findOrCreate({ email: }, (err, user) => {
        user.keycloakId = profile.keycloakId;
        user.imageUrl = profile.avatar; =;, savedUser) => done(err, savedUser));


  passport.authenticate("keycloak", DEFAULT_PASSPORT_OPTIONS)
  passport.authenticate("keycloak", DEFAULT_PASSPORT_OPTIONS),

Compatability with next-auth

There are some known issues with using this passportjs strategy with the latest versions of next-auth. Follow the discussion here.


All forms of contribution are welcome via Issues and Pull-requests to this repo