lua-resty-keycloak
is a Keycloak adaptar for OpenResty.
It provide OpenID Connect Resource Server functinality with keycloak IdP server.
It can verify ID Token from client using lua-resty-odic
.
It can support the Authorization Service provided by Keycloak. This function provides fine graind access controlle and integrate access policy to the keycloak server.
NOTE: The Authoriztion Service function is limited compared with the adapter provided by Keycloak. Only provides url based access contorl.
##Author Takashi Mogi, Hitachi,Ltd
TBD
local Authz = require "resty.keycloak.authz"
local Oidc = require "resty.keycloak.oidc"
local access_token,err = get_bearer_token()
if access_token == nil then
ngx.status = 403
ngx.say(err)
ngx.exit(ngx.HTTP_FORBIDDEN)
end
local opt = {
keycloak_uri = "http://keycloak.example.com/auth/realms/example/",
client_id = "client",
client_secret = "client_secret"
}
-- validate access token
local oidc = Oidc:new(opt)
local res, err = oidc:validate_token(access_token)
if err then
ngx.status=403
ngx.say(err)
ngx.exit(ngx.HTTP_FORBIDDEN)
end
local authz = Authz:new(opt)
authz:initialize()
-- check permissions using resource set provided by keycloak server
if not authz:is_authorize(access_token, ngx.var.uri) then
ngx.status = 403
ngx.exit(ngx.HTTP_FORBIDDEN)
end
- Common
- improve error handling and logging
- test cases
- use caches
- Authorization service
- "Authorization Scopes" and "Methods" based access control.
- improve path matchings between request path and resources.
- Wildcards: /*
- Suffix: /*.html
- Sub-paths: /path/*
- Path parameters: /resource/{id}
- Exact match: /resource
- Patterns: /{version}/resource, /api/{version}/resource, /api/{version}/resource/*