Multiple urlProviders on the same oauth setting in ktor with keycloak - authentication

Question

I am making a ktor web application with keycloak as auth.
val keycloakProvider = OAuthServerSettings.OAuth2ServerSettings(
name = CLIENT_NAME,
authorizeUrl = KEYCLOAK_AUTH,
accessTokenUrl = KEYCLOAK_TOKEN,
clientId = CLIENT_ID,
clientSecret = CLIENT_SECRET,
accessTokenRequiresBasicAuth = false,
requestMethod = HttpMethod.Post, // must POST to token endpoint
defaultScopes = listOf("roles")
)
There are multiple endpoints that I want to secure but the redirect URI can only be set to one URL, in the example below it's /login/oauth and /secret.
install(Authentication)
{
oauth("secretOAuth") {
client = HttpClient(Apache)
providerLookup = { keycloakProvider }
urlProvider = { "/secret" }
}
oauth("keycloakOAuth") {
client = HttpClient(Apache)
providerLookup = { keycloakProvider }
urlProvider = { "/login/oauth" }
}
}
Does it make sense to create multiple of these authentication paths like in the example above or would it be bad practice?
The /login/oauth and /secret are pointing to the following routes:
authenticate(keycloakOAuth) {
get("/login/oauth") {
val principal = call.authentication.principal<OAuthAccessTokenResponse.OAuth2>()
?: throw Exception("No principal was given")
createSession(principal)
call.respondRedirect("/")
}
}
authenticate(secretOAuth){
get("/secret")
{
val principal = call.authentication.principal<OAuthAccessTokenResponse.OAuth2>()
?: throw Exception("No principal was given")
createSession(principal)
call.respondHtml {
body{
h1{
+"You accessed secure page!"
}
}
}
}
}
Functionality wise it works, when the user isn't logged in it prompts them with the login window, otherwise they get to see the secret/their session gets created but I'm not sure if this is the correct way of doing it. Is there really no way to change the urlProvider based on the accessed URI? Because then I will have to make an authentication for each protected endpoint and that might be a bit too much.

Answer 1

In your scenario, it's redundant to have multiple authentication configurations for the same provider because a client can acquire an access token with any. I suggest using the authenticate block to just get an access token and save it somewhere. You can use the usual routes for the "secret" resources where you can check a user having an access token.
routing {
authenticate("keycloakOAuth") {
get("/login") {
// The endpoint for user login
}
get("/callback") {
val principal = call.authentication.principal<OAuthAccessTokenResponse.OAuth2>()
if (principal != null) {
// Save access token (principal.accessToken) for further use
} else {
// Something went wrong
}
}
}
get("/secret") {
if (!hasToken()) {
call.respondRedirect("/login")
}
}
}