lpotthast / axum-keycloak-auth

Protect axum routes with a JWT emitted by Keycloak.
https://crates.io/crates/axum-keycloak-auth
Apache License 2.0
34 stars 13 forks source link

feat: allow custom extra fields for `KeycloakToken` #9

Closed fMeow closed 7 months ago

fMeow commented 7 months ago

The should fix #7 and furthurmore provides ability to define custom jwt scopes/fields.

The previous version hard coded first_name, last_name, email and etc into KeycloakToken. But these tokens can actually be turned off, especially when configured with external identity services.

image

This PR add a generic parameter named Extra and passes it all the way through into KeycloakToken. Also, ProfileAndEmail is provided as the default Extra generic type, to meet the needs of most keycloak user that sticks with default usage (username/email/password authentication and never border to turned off profile or email scope).

I bump the version in Cargo.toml to 0.5.0, since this commit introduces some breaking API changes. There is no more token.full_name but token.extra.profile.preferred_username when Extra is set to ProfileAndEmail, which is the default generic type.

Here is an example to define and use custom jwt extra scopes:

// my tailored jwt scopes/fileds
#[derive(Deserialize, Clone)]
struct MyExtra {
    pub email: String,
    pub preferred_username: String,
    pub foo: String
}

pub async fn protected(Extension(token): Extension<KeycloakToken<String, MyExtra>>) -> Response {
    (StatusCode::OK,format!("Hello {}", token.extra.foo)).into_response()
}

let router = Router::new().route("/protected", get(protected)).layer(
        KeycloakAuthLayer::<String, MyExtra>::builder()
            .instance(instance)
            .passthrough_mode(PassthroughMode::Block)
            .persist_raw_claims(false)
            .expected_audiences(vec![])
            .required_roles(vec![])
            .build(),
);
lpotthast commented 7 months ago

Thanks for all the changes! Will look over them this afternoon.

lpotthast commented 7 months ago

Looks good!