InternalOAuthError: Failed to fetch user profile (Solved)

[hsyhhssyy]

It seems like this project has stopped being maintained, so I'm leaving an Issue here for people who encounter this problems.

Due to Keycloak's pull request, the 'openid' scope has been made mandatory for userinfo endpoints. Unfortunately, some invokers, such as Node-Red, tend to call upon it with a default scope, thereby neglecting to explicitly pass the 'openid' scope. The default scope is 'email profile roles', which triggers an error.

You can actually specify the scope explicitly by configuring it in the parameters.

var KeyCloakStrategy = require('passport-keycloak-oauth2-oidc').Strategy;
passport.use(new KeyCloakStrategy({
    clientID: 'myOauthClient',
    realm: 'MyKeyCloakRealm',
    publicClient: 'false',
    clientSecret: '6ee0f303-faef-42d7-ba8e-00cdec755c42',
    sslRequired: 'external',
    scope: "openid profile email",
    authServerURL: 'https://keycloak.example.com/auth',
    callbackURL: 'https://www.example.com/keycloak/callback'
  },
  function(accessToken, refreshToken, profile, done) {
    User.findOrCreate(..., function err, user) {
      done(err, user);
    });
  }
});

If you suspect that you might have encountered this problem, but aren't entirely sure, then you can insert a new line into the /lib/strategy.js in the node_modules for printing the access token after line 120. Subsequently, utilize a JWT analysis tool to decode the JWT token to establish if it offers an 'openid' scope.

this._oauth2._useAuthorizationHeaderForGET = true;
console.log("access_token",accessToken) // Add this line

[krutogorec]

Thanks a lot :)