-
Notifications
You must be signed in to change notification settings - Fork 150
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3796 from uselagoon/keycloak-upgrade
Upgrade keycloak to version 24
- Loading branch information
Showing
25 changed files
with
1,058 additions
and
1,060 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,78 +1,67 @@ | ||
| import axios from 'axios'; | ||
| import { decode } from 'jsonwebtoken'; | ||
| import { KeycloakAdminClient } from '@s3pweb/keycloak-admin-client-cjs'; | ||
| import { logger } from '../loggers/logger'; | ||
| const KeycloakAdmin = require('keycloak-admin').default; | ||
| const { Agent: KeycloakAgent } = require('keycloak-admin/lib/resources/agent'); | ||
| import { config } from './keycloakClient'; | ||
|
|
||
| /** | ||
| * Everytime an API request is made, check if the access_token is (or will soon | ||
| * be) expired. If so, get a new token before making the request. | ||
| */ | ||
| class RetryAgent extends KeycloakAgent { | ||
| constructor(args) { | ||
| super(args); | ||
| } | ||
| /// Helper to type check try/catch. Remove when we can stop using the @s3pweb | ||
| // commonJS version. | ||
| export const isNetworkError = ( | ||
| error: unknown, | ||
| ): error is { | ||
| response: { | ||
| status: number; | ||
| }; | ||
| } => { | ||
| return ( | ||
| typeof error === 'object' && | ||
| 'response' in error && | ||
| typeof error.response === 'object' | ||
| ); | ||
| }; | ||
|
|
||
| request(args) { | ||
| const parentRequest = super.request(args); | ||
| return async payload => { | ||
| const accessToken = this.client.getAccessToken(); | ||
| const tokenRaw = Buffer.from(accessToken.split('.')[1], 'base64'); | ||
| const token = JSON.parse(tokenRaw.toString()); | ||
| const date = new Date(); | ||
| const now = Math.floor(date.getTime() / 1000); | ||
| export const getKeycloakAdminClient = async (): Promise<KeycloakAdminClient> => { | ||
| const keycloakAdminClient = new KeycloakAdminClient({ | ||
| baseUrl: `${config.origin}/auth`, | ||
| realmName: config.realm, | ||
| }); | ||
|
|
||
| if (token.exp - 10 <= now) { | ||
| logger.debug('keycloakAdminClient: refreshing expired token'); | ||
| await this.client.auth(); | ||
| } | ||
| /** | ||
| * Use a custom token provider that can automatically refresh expired tokens. | ||
| */ | ||
| keycloakAdminClient.registerTokenProvider({ | ||
| async getAccessToken() { | ||
|
|
||
| return parentRequest(payload); | ||
| }; | ||
| } | ||
| } | ||
| if (keycloakAdminClient.accessToken) { | ||
| const token = decode(keycloakAdminClient.accessToken); | ||
| const now = Math.floor(Date.now() / 1000); | ||
|
|
||
| /** | ||
| * Use our custom RetryAgent and save credentials internally for re-auth tasks. | ||
| */ | ||
| export class RetryKeycloakAdmin extends KeycloakAdmin { | ||
| constructor(connectionConfig, credentials) { | ||
| const agent = new RetryAgent({ | ||
| getUrlParams: client => ({ | ||
| realm: client.realmName | ||
| }), | ||
| getBaseUrl: client => client.baseUrl, | ||
| axios | ||
| }); | ||
| if (token.exp - 30 > now) { | ||
| return keycloakAdminClient.accessToken; | ||
| } | ||
|
|
||
| super(connectionConfig, agent); | ||
| logger.debug('keycloakAdminClient: refreshing expired token'); | ||
| } | ||
|
|
||
| this.credentials = credentials; | ||
| } | ||
| // Always auth against master realm. | ||
| const curRealm = keycloakAdminClient.realmName; | ||
| keycloakAdminClient.setConfig({ | ||
| realmName: 'master', | ||
| }); | ||
|
|
||
| async auth() { | ||
| const curRealm = this.realmName; | ||
| this.realmName = this.credentials.realmName; | ||
| await super.auth(this.credentials); | ||
| this.realmName = curRealm; | ||
| } | ||
| } | ||
| await keycloakAdminClient.auth({ | ||
| username: config.user, | ||
| password: config.pass, | ||
| grantType: 'password', | ||
| clientId: 'admin-cli', | ||
| }); | ||
|
|
||
| export const getKeycloakAdminClient = async () => { | ||
| const keycloakAdminClient = new RetryKeycloakAdmin( | ||
| { | ||
| baseUrl: `${config.origin}/auth`, | ||
| realmName: config.realm | ||
| keycloakAdminClient.setConfig({ | ||
| realmName: curRealm, | ||
| }); | ||
|
|
||
| return keycloakAdminClient.accessToken; | ||
| }, | ||
| { | ||
| realmName: 'master', | ||
| username: config.user, | ||
| password: config.pass, | ||
| grantType: 'password', | ||
| clientId: 'admin-cli' | ||
| } | ||
| ); | ||
| await keycloakAdminClient.auth(); | ||
| }); | ||
|
|
||
| return keycloakAdminClient; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.