This repository consist of a HapiJS auth plugin which delegates authorization concerns to the Keycloak server.

This package:

• Defines a keycloak Hapijs auth scheme so that it can be used as follows:

  server.auth.strategy('keycloak', 'keycloak');
  server.auth.default('keycloak');
  server.route({
      method: ['GET'],
      path: '/restricted',
      handler(request, reply) {
          return `Hello, ${request.auth.credentials.name}!`; // this will return user's full name.
      },
      options: {
         auth: {
              access: {
                  scope: ['view-reports', 'manage-reports'] // Optionally, these are required Keycloak roles for this endpoint.
              }
          }
      }
  });

• Exposes 3 endpoints intended to be used with frontend web apps:

  • Login endpoint (/sso/login) which handles OAuth2.0's Authorization Code redirection flow.
  • Logout endpoint (/sso/logout) which handles sign out procedure.
  • Principal endpoint (/api/principal) which gives access to resource owner's data (such as its name, access token, ID token, change password URL, logout URL etc.)

$ npm install keycloak-hapi --save

const server = new Hapi.Server();

try {
  /*
   * The package uses yar for session management so this bit is required 
   * if you're writing a frontend web app (bearerOnly = false).
   */
  await server.register({
      plugin: require('@hapi/yar'),
      options: {
          storeBlank: false,
          name: 'kc_session',
          maxCookieSize: 0,
          cookieOptions: {
              password: 'the-password-must-be-at-least-32-characters-long',
              isSecure: false // use true for production (https).
          }
      }
  });
  
  await server.register({
      plugin: require('keycloak-hapi'),
      options: {
          serverUrl: 'http://localhost:8080/auth',
          realm: 'master',
          clientId: 'my-app',
          clientSecret: '6a0dd495-09bc-4ed1-87a2-3367bb75b05d',
          bearerOnly: false // set it to true if you're writing a resource server (REST API).
      }
  });
  
  server.auth.strategy('keycloak', 'keycloak');
  server.auth.default('keycloak');
  
} catch(err) {
    console.error(err);
}

await server.start();

The following plugin options are available to be set:

See https://github.com/novomatic-tech/keycloak-examples/tree/master/app-web-nodejs

This package requires the @hapi/yar library at least in version 10.1.1.