Add Keycloak to express server to get kauth from request - express

Question

I am trying to add Keycloak authentication to my ApolloServer using keycloak-connect.
I have setup my realm and login from localhost:8080/auth. However, I am having an issue getting kauth from my requests in the context function:
Currently I have the following setup:
const kcConfig = {
clientId: process.env.KEYCLOAK_CLIENT_ID,
serverUrl: `localhost:808/auth`,
realm: process.env.KEYCLOAK_REALM,
realmPublicKey: process.env.KEYCLOAK_REALM_PUBLIC_KEY,
}
const memoryStore = new session.MemoryStore()
app.use(session({
secret: process.env.SESSION_SECRET_STRING || 'this should be a long secret',
resave: false,
saveUninitialized: true,
store: memoryStore
}))
const keycloak = new Keycloak({
store: memoryStore
}, kcConfig as any)
// Install general keycloak middleware
app.use(keycloak.middleware({
admin: graphqlPath
}))
// Protect the main route for all graphql services
// Disable unauthenticated access
app.use(graphqlPath, keycloak.middleware())
And then I try to access req.kauth in context like:
export interface GrantedRequest extends Request {
kauth : {grant?: Grant};
}
const server = new ApolloServer({
engine: {
graphVariant: "current"
},
context: ({req, res} : {
req: GrantedRequest,
res: any
}) => {
console.log(req.kauth) // this line prints an empty object
return {
req,
res,
kauth: req.auth
}
},
schema,
playground: {
settings: {
"request.credentials": "same-origin"
}
}
});
However, I am not able to retrieve the kauth property from my request. How can I solve this issue?

Answer 1

Keycloak authentication is not used until you define a resource which is protected. Compare to comment in https://github.com/keycloak/keycloak-nodejs-connect/blob/master/keycloak.js#L92
Because you only define the keycloak.middleware() function, does not mean, that your resoures are protected.
To achieve login and receive access token from keycloak, you need to use keycloak.protect() or keycloak.checkSso() or keycloak.enforcer(). Therefore you have to assign these as request-handler to either URL
app.get('/proteced-resource', keycloak.protect())
or application
app.use(keycloak.protect()).