feat: add keycloak authentication closes #1634

backend/src/clients/cognito.ts

@@ -12,6 +12,9 @@ export async function listUsers(query: string, exactMatch = false) {
   let dnName: string
   let userPoolId: string
   try {
+    if (!config?.oauth?.cognito) {
+      throw ConfigurationError('OAuth Cognito configuration is missing')
+    }
     dnName = config.oauth.cognito.userIdAttribute
     userPoolId = config.oauth.cognito.userPoolId
   } catch (e) {

backend/src/clients/keycloak.ts

@@ -0,0 +1,84 @@
+import c from 'config'
+import { UserInformation } from '../connectors/authentication/Base.js'
+import config from '../utils/config.js'
+import { ConfigurationError, InternalError } from '../utils/error.js'
+
+export async function listUsers(query: string, exactMatch = false) {
+  let dnName: string
+  let realm: string
+  try {
+    if (!config?.oauth?.keycloak) {
+      throw ConfigurationError('OAuth Keycloak configuration is missing')
+    }
+    realm = config.oauth.keycloak.realm
+  } catch (e) {
+    throw ConfigurationError('Cannot find userIdAttribute in oauth configuration', { oauthConfiguration: config?.oauth })
+  }
+
+  const token = await getKeycloakToken()
+
+  const filter = exactMatch ? `${query}` : `${query}*`
+  const url = `${config.oauth.keycloak.serverUrl}/admin/realms/${realm}/users?search=${filter}`
+
+  let results
+  try {
+    results = await fetch(url, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${token}`
+      }
+    })
+  } catch (err) {
+    throw InternalError('Error when querying Keycloak for users.', { err })
+  }
+  const resultsData = await results.json() as any[]
+  console.log(resultsData)
+  if (!resultsData || resultsData.length === 0) {
+    return []
+  }
+
+  const initialValue: Array<UserInformation & { dn: string }> = []
+  const users = resultsData.reduce((acc, keycloakUser) => {
+    const dn = keycloakUser.id // Assuming 'id' is the dnName
+    if (!dn) {
+      return acc
+    }
+    const email = keycloakUser.email
+    const name = keycloakUser.firstName
+    const info: UserInformation = {
+      ...(email && { email }),
+      ...(name && { name }),
+    }
+    acc.push({ ...info, dn })
+    return acc
+  }, initialValue)
+  return users
+}
+
+async function getKeycloakToken() {
+  if (!config?.oauth?.keycloak) {
+    throw ConfigurationError('OAuth Keycloak configuration is missing')
+  }
+  const url = `${config.oauth.keycloak.serverUrl}/realms/${config.oauth.keycloak.realm}/protocol/openid-connect/token`
+  const params = new URLSearchParams()
+  params.append('client_id', config.oauth.keycloak.clientId)
+  params.append('client_secret', config.oauth.keycloak.clientSecret)
+  params.append('grant_type', 'client_credentials')
+
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded'
+      },
+      body: params
+    })
+    const data = await response.json() as { access_token: string }
+    if (!data.access_token) {
+      throw InternalError('Access token is missing in the response', { response: data })
+    }
+    return data.access_token
+  } catch (err) {
+    throw InternalError('Error when obtaining Keycloak token.', { err })
+  }
+}

backend/src/connectors/authentication/oauth.ts

@@ -3,14 +3,26 @@ import { NextFunction, Request, Response, Router } from 'express'
 import session from 'express-session'
 import grant from 'grant'
 
-import { listUsers } from '../../clients/cognito.js'
+import { listUsers as listUsersCognito } from '../../clients/cognito.js'
+import { listUsers as listUsersKeycloak } from '../../clients/keycloak.js'
+
 import { UserInterface } from '../../models/User.js'
 import config from '../../utils/config.js'
 import { getConnectionURI } from '../../utils/database.js'
 import { fromEntity, toEntity } from '../../utils/entity.js'
 import { InternalError, NotFound } from '../../utils/error.js'
 import { BaseAuthenticationConnector, RoleKeys, UserInformation } from './Base.js'
 
+function listUsers(query: string, exactMatch = false) {
+  if (config.oauth.cognito) {
+    return listUsersCognito(query, exactMatch)
+  } else if (config.oauth.keycloak) {
+    return listUsersKeycloak(query, exactMatch)
+  } else {
+    throw InternalError('No oauth configuration found', { oauthConfiguration: config.oauth })
+  }
+}
+
 const OauthEntityKind = {
   User: 'user',
 } as const

backend/src/utils/config.ts

@@ -114,11 +114,17 @@ export interface Config {
   oauth: {
     provider: string
     grant: grant.GrantConfig | grant.GrantOptions
-    cognito: {
+    cognito?: {
       identityProviderClient: { region: string; credentials: { accessKeyId: string; secretAccessKey: string } }
       userPoolId: string
       userIdAttribute: string
     }
+    keycloak?: {
+      realm: string
+      clientId: string
+      clientSecret: string
+      serverUrl: string
+    }
   }
 
   defaultSchemas: {
@@ -172,4 +178,12 @@ export interface Config {
 }
 
 const config: Config = _config.util.toObject()
+
+if (config.oauth &&
+  !config.oauth.keycloak &&
+  !config.oauth.cognito
+) {
+  throw new Error('If OAuth is configured, either Keycloak or Cognito configuration must be provided.')
+}
+
 export default deepFreeze(config) as Config