Skip to content

feat: add config option rolesJwtClaim in AuthKeycloakRedirect provider #320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 22, 2024
Merged

feat: add config option rolesJwtClaim in AuthKeycloakRedirect provider #320

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 26 additions & 7 deletions src/AuthKeycloakRedirect/AuthKeycloakRedirect.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,14 +150,33 @@ const _updateTokensInStorage = (tokens) => {
};

const _extractRolesFromAccessToken = (accessToken) => {
let result = [];
if (accessToken) {
const decodedToken = JSON.parse(atob(accessToken.split('.')[1]));
// The exact key to use may depend from keycloak client & API configuration
if (decodedToken?.roles) result = decodedToken.roles;
else if (decodedToken?.userRoles) result = decodedToken.userRoles;
if (!accessToken) return [];

const decodedToken = JSON.parse(atob(accessToken.split('.')[1]));
// The exact key to use may depend from keycloak client & Cosmo Tech API configuration (c.f. the value of
// csm.platform.authorization.roles-jwt-claim in your k8s tenant secrets)
const rolesTokenAttribute = config?.rolesJwtClaim;
if (rolesTokenAttribute) {
if (decodedToken?.[rolesTokenAttribute]) return decodedToken?.[rolesTokenAttribute];
console.warn(
`Authentication provider configuration defined rolesJwtClaim="${rolesTokenAttribute}" ` +
'but this key was not found in the access token. Please check your webapp and API configuration.'
);
}

if (decodedToken?.roles) return decodedToken.roles; // Legacy default key in token

if (decodedToken?.userRoles) {
console.warn(
"DEPRECATED: the token claim for API roles was automatically found in 'userRoles', but the lookup " +
'for this specific key will be removed in a future version. Please update your webapp configuration to ' +
"explicitly set AUTH_KEYCLOAK_ROLES_JWT_CLAIM to 'userRoles'."
);
return decodedToken.userRoles;
}
return result;

console.warn("Couldn't extract roles from access token. Please check your webapp and API configuration.");
return [];
};

export const isUserSignedIn = async () => {
Expand Down