Skip to content

fix: fix user roles when using keycloak auth provider #319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 23, 2024
Merged

fix: fix user roles when using keycloak auth provider #319

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 19 additions & 20 deletions src/AuthKeycloakRedirect/AuthKeycloakRedirect.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ const clearFromStorage = (key) => localStorage.removeItem(key);

export const name = 'auth-keycloakRedirect';
const authData = {
authenticated: readFromStorage('authAuthenticated') === 'true',
accountId: undefined,
userEmail: undefined,
username: undefined,
Expand Down Expand Up @@ -76,30 +75,27 @@ const _acquireTokensByRequestAndAccount = async (tokenReq, account) => {
export const acquireTokens = async (forceRefresh = false) => {
if (!checkInit()) return;

if (!forceRefresh) {
if (!forceRefresh && readFromStorage('authAuthenticated') === 'true') {
const idToken = readFromStorage('authIdToken');
const accessToken = readFromStorage('authAccessToken');
const authenticated = readFromStorage('authAuthenticated') === 'true';
if (authenticated && idToken != null && accessToken != null) {
return { accessToken, idToken };
}
return { accessToken, idToken };
}

const account = msalApp.getAllAccounts()?.[0];
if (account === undefined) return;

return await _acquireTokensByRequestAndAccount(config.accessRequest, account);
const tokens = await _acquireTokensByRequestAndAccount(config.accessRequest, account);
_updateTokensInStorage(tokens);
return tokens;
};

const handleResponse = (response) => {
if (response != null) {
const account = response.account;
_updateTokensInStorage(response);
writeToStorage('authIdTokenPopup', response.idToken);
writeToStorage('authIdToken', response.idToken);
writeToStorage('authAccessToken', response.accessToken);
writeToStorage('authAuthenticated', 'true');
writeToStorage('authAccountId', account.homeAccountId);
authData.authenticated = true;
authData.accountId = account.homeAccountId;
authData.userEmail = account.username; // In MSAL account data, username property contains user email
authData.username = account.name;
Expand Down Expand Up @@ -147,24 +143,30 @@ export const isAsync = () => {

const _updateTokensInStorage = (tokens) => {
if (tokens?.idToken) writeToStorage('authIdToken', tokens.idToken);
if (tokens?.accessToken) writeToStorage('authAccessToken', tokens.accessToken);
if (tokens?.accessToken) {
writeToStorage('authAccessToken', tokens.accessToken);
authData.roles = _extractRolesFromAccessToken(tokens.accessToken);
}
};

const _extractRolesFromAccessToken = (accessToken) => {
let result = [];
if (accessToken) {
const decodedToken = JSON.parse(atob(accessToken.split('.')[1]));
if (decodedToken?.roles) {
result = decodedToken?.roles;
}
// The exact key to use may depend from keycloak client & API configuration
if (decodedToken?.roles) result = decodedToken.roles;
else if (decodedToken?.userRoles) result = decodedToken.userRoles;
}
return result;
};

export const isUserSignedIn = async () => {
if (authData.authenticated) return true;
if (readFromStorage('authAuthenticated') === 'true') {
authData.authenticated = true;
// Restore roles from access token if necessary (roles in auhtData may be lost after login redirection)
if (authData.roles.length === 0) {
const accessToken = readFromStorage('authAccessToken');
if (accessToken) authData.roles = _extractRolesFromAccessToken(accessToken);
}
return true;
}

Expand All @@ -188,10 +190,7 @@ export const isUserSignedIn = async () => {
// Otherwise, try to acquire a token silently to implement SSO
const tokens = await acquireTokens();
_updateTokensInStorage(tokens);
if (tokens?.accessToken !== undefined) {
authData.roles = _extractRolesFromAccessToken(tokens.accessToken);
return true;
}
if (tokens?.accessToken !== undefined) return true;
} catch (e) {
console.error(e);
}
Expand Down