Keycloak test #612

pozylon · 2024-12-13T15:36:25Z

No description provided.

pozylon · 2024-12-13T15:36:59Z

This is just an experiment connecting unchained with a self-hosted Keycloak server.

examples/minimal/boot.ts

+  fastify.get('/callback', async function (request, reply) {
+    const accessToken = await this.keycloak.getAccessTokenFromAuthorizationCodeFlow(request);
+    try {
+      const userinfo = await this.keycloak.userinfo(accessToken.token.access_token);
+      const { sub, email, resource_access, email_verified, name, given_name, family_name } = userinfo;
+      const roles = resource_access?.['unchained-local']?.roles || [];
+      const user = await engine.unchainedAPI.modules.users.findUserByUsername(`keycloak:${sub}`);
+
+      if (user) {
+        if (JSON.stringify(user.roles) !== JSON.stringify(roles)) {
+          await engine.unchainedAPI.modules.users.updateRoles(user._id, roles);
+        }
+        request.unchainedContext.login(user);
+        return reply.redirect('/');
+      }
+      // TODO: try to use the preferred_username as the username first
+      const newUserId = await engine.unchainedAPI.modules.users.createUser(
+        {
+          username: `keycloak:${sub}`,
+          password: null,
+          email: email_verified ? email : undefined,
+          profile: {
+            displayName: name,
+            address: {
+              firstName: given_name,
+              lastName: family_name,
+            },
+          },
+          roles,
+        },
+        { skipMessaging: true, skipPasswordEnrollment: true },
+      );
+      const newUser = await engine.unchainedAPI.modules.users.findUserById(newUserId);
+      request.unchainedContext.login(newUser);
+      return reply.redirect('/');
+    } catch (e) {
+      console.error(e);
+    }
+
+    // if later need to refresh the token this can be used
+    // const { token: newToken } = await this.getNewAccessTokenUsingRefreshToken(token)
+
+    return reply.send({ access_token: token.access_token });
+  });


To fix the problem, we need to introduce rate limiting to the Fastify application. We can use the @fastify/rate-limit plugin to achieve this. This plugin allows us to set a maximum number of requests per time window for each IP address, which will help mitigate the risk of denial-of-service attacks.

We will:

Install the @fastify/rate-limit package.

Register the rate limiting plugin with the Fastify instance.

Configure the rate limiting settings to a reasonable default, such as 100 requests per 15 minutes.

pozylon added 4 commits December 13, 2024 16:03

Keycloak test

5d87a37

Working prototype!

e216d01

Fix deps

09397d9

Update packages

cca9747

pozylon marked this pull request as draft December 13, 2024 15:36

github-advanced-security bot found potential problems Dec 13, 2024

View reviewed changes

@@ -8,2 +8,3 @@
             import FastifyOAuth2 from '@fastify/oauth2';
+            import FastifyRateLimit from '@fastify/rate-limit';
@@ -25,2 +26,7 @@
               });
+              await fastify.register(FastifyRateLimit, {
+                max: 100, // maximum 100 requests per 15 minutes
+                timeWindow: '15 minutes'
+              });

@@ -41,3 +41,4 @@
                 "@unchainedshop/plugins": "^3.0.0-alpha4",
-                "fastify": "^5.1.0"
+                "fastify": "^5.1.0",
+                "@fastify/rate-limit": "^10.2.1"
               },

Package	Version	Security advisories
@fastify/rate-limit (npm)	10.2.1	None

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keycloak test #612

Keycloak test #612

pozylon commented Dec 13, 2024

pozylon commented Dec 13, 2024

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Keycloak test #612

Are you sure you want to change the base?

Keycloak test #612

Conversation

pozylon commented Dec 13, 2024

pozylon commented Dec 13, 2024