search

Nerzal / gocloak

golang keycloak client
Apache License 2.0
1.01k stars 275 forks source link

Token Mediation / BFF Pattern Authentication Patter Redirect #454

Open safaci2000 opened 8 months ago

safaci2000 commented 8 months ago

Is your feature request related to a problem? Please describe. Is Token Mediation pattern supported by gocloak? I've looked over the docs but honestly couldn't find a way of doing it.

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-token-mediating-backend

Describe the solution you'd like The ability to redirect a user to keycloak for authentication.

Additional context

                       +-------------+  +--------------+ +--------------+
                            |             |  |              | |              |
                            |Authorization|  |    Token     | |   Resource   |
                            |  Endpoint   |  |   Endpoint   | |    Server    |
                            |             |  |              | |              |
                            +-------------+  +--------------+ +--------------+

                                ^                        ^              ^
                                |                     (F)|           (K)|
                                |                        v              v

                                |         +-----------------------------------+
                                |         |                                   |
                                |         |    Backend for Frontend  (BFF)    |
                             (D)|         |                                   |
                                |         +-----------------------------------+
                                |
                                |           ^     ^     ^     +       ^  +
                                |      (B,I)|  (C)|  (E)|  (G)|    (J)|  |(L)
                                v           v     v     +     v       +  v

+-----------------+         +-------------------------------------------------+
|                 |  (A,H)  |                                                 |
| Static Web Host | +-----> |                    Browser                      |
|                 |         |                                                 |
+-----------------+         +-------------------------------------------------+

When no active session is found, the JavaScript application calls out to the BFF (C) to initiate the Authorization Code flow with the PKCE extension (described in Section 6.1.3.1), to which the BFF responds by redirecting the browser to the authorization endpoint (D). When the user is redirected back, the browser delivers the authorization code to the BFF (E), where the BFF can then exchange it for tokens at the token endpoint (F) using its client secret and PKCE code verifier.