search

keycloak / keycloak-nodejs-connect

Apache License 2.0
676 stars 421 forks source link

KeyCloak URLs should not be constructed with the auth-server-url but with the openid-configuration response #418

Open rfx77 opened 2 years ago

rfx77 commented 2 years ago

Describe the bug

Currently the realmUrl and other URLs are constructed by prefixing them with the auth-server-url from the config file. The auth-server-url should only be uses to get the openid-configuration:

/realms//.well-known/openid-configuration In the response of this request you can get all necessary urls (eg logout, autohorization-endpoint,...) ### Version 12 ### Expected behavior Get all openid related endpoints from /realms//.well-known/openid-configuration ### Actual behavior https://github.com/keycloak/keycloak-nodejs-connect/blob/dd1c20f0c1e6366e98434128eafea2e78ab545fd/middleware/auth-utils/config.js#L125 https://github.com/keycloak/keycloak-nodejs-connect/blob/dd1c20f0c1e6366e98434128eafea2e78ab545fd/middleware/auth-utils/config.js#L131 https://github.com/keycloak/keycloak-nodejs-connect/blob/dd1c20f0c1e6366e98434128eafea2e78ab545fd/keycloak.js#L388 https://github.com/keycloak/keycloak-nodejs-connect/blob/dd1c20f0c1e6366e98434128eafea2e78ab545fd/keycloak.js#L403 ### How to Reproduce? _No response_ ### Anything else? _No response_