How to use (support request)

[nickrobillard]

Hi @felixheck - I have borrowed your example code in the readme (https://github.com/felixheck/hapi-auth-keycloak#example) but I am a little unsure where to go from there.

I attempted to use client/secret method by adding my Keycloak client's clientId and secret to my options object, but I still see:

{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Missing or invalid authorization header",
  "attributes": {
    "strategy": "keycloak-jwt",
    "error": "Missing or invalid authorization header"
  }
}

I dug in a little bit and I can see that an Authorization header with bearer token is expected. So is every request to my Hapi endpoint expected to have this header set? That would make sense since the bearer token is user specific and needed in order to correctly authorize the user. After reading your reply in #8, it sounds like the job of getting the bearer token falls outside the responsibility of hapi-auth-keycloak. Is this correct?

[felixheck]

Thanks for your request. Seems that I have to add a few point to the README :)

1. Send access_token as authorization: bearer <access_token>
2. this plugin is just for validation/authorization of keycloak-based bearers currently
3. the plugin uses access_tokens as user specific tokens. BUT there are some keycloak api key service which introduces api keys to keycloak by requesting access tokens again & again. There'll be a minor release which allows to use such api keys services as interceptor for authorization: Api-Key <key> requests; the api key service itself is not part of the minor release :)

If there's need for requesting tokens via this plugins, redirect to the UI like in #8 etc I'd be really hapi if you contribute :)

P.S. because all the other hapi-auth-* plugins just handles the credential validation + authorization as well, I'd like to reduce the features to the minimum. I use https://github.com/keycloak/keycloak-nodejs-auth-utils for lots of stuff. The grant manager enables to request tokens in various manners..perhaps this is the more elegant way. Nevertheless redirect is a possible feature.

[nickrobillard]

I appreciate your quick response. That all makes sense. In general, I'm all for separation of concerns and keeping things lean. I did notice keycloak-nodejs-auth-utils while digging into the Express middleware and I will definitely leverage it here. Thanks!

PS: Are you concerned that https://github.com/keycloak/keycloak-nodejs-auth-utils has been merged into https://github.com/keycloak/keycloak-nodejs-connect and won't be maintained on its own?

[felixheck]

Thanks for the hint! Gonna switch to nodejs-connect with the next minor :)