Protect axum routes with a JWT emitted by Keycloak.
AuthError
is converted into a response. Giving the user control and the ability to add context, roll their own.This library provides KeycloakAuthLayer
, a tower layer/service implementation that parses and validates a JWT.
See the Documentation for more detailed instructions!
enum Role {
Administrator,
Unknown(String),
}
pub fn protected_router(instance: KeycloakAuthInstance) -> Router {
Router::new()
.route("/protected", get(protected))
.layer(
KeycloakAuthLayer::<Role>::builder()
.instance(instance)
.passthrough_mode(PassthroughMode::Block)
.build(),
)
}
pub async fn protected(Extension(token): Extension<KeycloakToken<Role>>) -> Response {
expect_role!(&token, Role::Administrator);
info!("Token payload is {token:#?}");
(
StatusCode::OK,
format!(
"Hello {name} ({subject}). Your token is valid for another {valid_for} seconds.",
name = token.extra.profile.preferred_username,
subject = token.subject,
valid_for = (token.expires_at - time::OffsetDateTime::now_utc()).whole_seconds()
),
).into_response()
}
axum | axum-keycloak-auth |
---|---|
0.6 | 0.2 |
0.7 | 0.3 - 0.5 |
Run test with
cargo test
Pass the --nocapture
flag when developing to be able to see log/tracing output.
cargo test -- --nocapture