{signingIn ? (
diff --git a/src/app/(drift)/(auth)/signin/page.tsx b/src/app/(drift)/(auth)/signin/page.tsx
index c656c9d8..682ad512 100644
--- a/src/app/(drift)/(auth)/signin/page.tsx
+++ b/src/app/(drift)/(auth)/signin/page.tsx
@@ -1,15 +1,16 @@
import { getMetadata } from "src/app/lib/metadata"
-import config from "@lib/config"
-import Auth from "../components"
-function isGithubEnabled() {
- return config.github_client_id.length && config.github_client_secret.length
- ? true
- : false
-}
+import Auth from "../components"
+import { getAuthProviders, isCredentialEnabled } from "@lib/server/auth-props"
export default function SignInPage() {
- return
+ return (
+
+ )
}
export const metadata = getMetadata({
diff --git a/src/app/(drift)/(auth)/signup/page.tsx b/src/app/(drift)/(auth)/signup/page.tsx
index 6cdd7bf4..9ba57ef6 100644
--- a/src/app/(drift)/(auth)/signup/page.tsx
+++ b/src/app/(drift)/(auth)/signup/page.tsx
@@ -1,25 +1,20 @@
import Auth from "../components"
import { getRequiresPasscode } from "src/pages/api/auth/requires-passcode"
-import config from "@lib/config"
import { getMetadata } from "src/app/lib/metadata"
+import { getAuthProviders, isCredentialEnabled } from "@lib/server/auth-props"
async function getPasscode() {
return await getRequiresPasscode()
}
-function isGithubEnabled() {
- return config.github_client_id.length && config.github_client_secret.length
- ? true
- : false
-}
-
export default async function SignUpPage() {
const requiresPasscode = await getPasscode()
return (
)
}
diff --git a/src/app/components/header/buttons.tsx b/src/app/components/header/buttons.tsx
index 6ebb4fc8..c057beef 100644
--- a/src/app/components/header/buttons.tsx
+++ b/src/app/components/header/buttons.tsx
@@ -45,14 +45,15 @@ export function HeaderButtons({
isAuthenticated: boolean
theme: string
}) {
- const { isAdmin } = useSessionSWR()
+ const { isAdmin, userId } = useSessionSWR()
return (
<>
{getButtons({
isAuthenticated,
theme,
- isAdmin
+ isAdmin,
+ userId
})}
)
@@ -108,12 +109,14 @@ export function getButtons({
isAuthenticated,
theme,
// mutate: mutateSession,
- isAdmin
+ isAdmin,
+ userId
}: {
isAuthenticated: boolean
theme: string
// mutate: KeyedMutator
- isAdmin?: boolean
+ isAdmin?: boolean,
+ userId?: string
}) {
return [
}
value="signout"
onClick={() => {
- signOut()
+ signOut({
+ callbackUrl: `/signedout${
+ userId ? "?userId=" + userId : ""
+ }`
+ })
}}
width={SIGN_IN_WIDTH}
/>
diff --git a/src/lib/config.ts b/src/lib/config.ts
index 1a9f066d..e0dd9267 100644
--- a/src/lib/config.ts
+++ b/src/lib/config.ts
@@ -7,6 +7,10 @@ type Config = {
url: string
github_client_id: string
github_client_secret: string
+ keycloak_client_id: string
+ keycloak_client_secret: string
+ keycloak_issuer: string
+ keycloak_name: string
nextauth_secret: string
credential_auth: boolean
}
@@ -83,8 +87,12 @@ export const config = (env: Environment): Config => {
`https://${throwIfUndefined("VERCEL_URL")}`,
github_client_id: env.GITHUB_CLIENT_ID ?? "",
github_client_secret: env.GITHUB_CLIENT_SECRET ?? "",
+ keycloak_client_id: env.KEYCLOAK_ID ?? "",
+ keycloak_client_secret: env.KEYCLOAK_SECRET ?? "",
+ keycloak_issuer: env.KEYCLOAK_ISSUER ?? "",
+ keycloak_name: env.KEYCLOAK_NAME ?? "",
nextauth_secret: throwIfUndefined("NEXTAUTH_SECRET"),
- credential_auth: stringToBoolean("CREDENTIAL_AUTH") ?? true
+ credential_auth: stringToBoolean(env.CREDENTIAL_AUTH) ?? true
}
return config
}
diff --git a/src/lib/server/auth-props.ts b/src/lib/server/auth-props.ts
new file mode 100644
index 00000000..3e4d74f1
--- /dev/null
+++ b/src/lib/server/auth-props.ts
@@ -0,0 +1,38 @@
+import config from "@lib/config"
+
+export type AuthProviders = {
+ enabled: boolean
+ id: "keycloak" | "github"
+ public_name: string
+}[]
+
+export function isGithubEnabled(): boolean {
+ return !!(config.github_client_id && config.github_client_secret)
+}
+
+export function isKeycloakEnabled(): boolean {
+ return !!(
+ config.keycloak_client_id &&
+ config.keycloak_client_secret &&
+ config.keycloak_issuer
+ )
+}
+
+export function isCredentialEnabled(): boolean {
+ return config.credential_auth
+}
+
+export function getAuthProviders(): AuthProviders {
+ return [
+ {
+ enabled: isGithubEnabled(),
+ id: "github",
+ public_name: "Github"
+ },
+ {
+ enabled: isKeycloakEnabled(),
+ id: "keycloak",
+ public_name: config.keycloak_name || "Keycloak"
+ }
+ ]
+}
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 2cbbaf27..c54b6254 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,10 +1,16 @@
import { PrismaAdapter } from "@next-auth/prisma-adapter"
-import { NextAuthOptions } from "next-auth"
+import { NextAuthOptions, User } from "next-auth"
import GitHubProvider from "next-auth/providers/github"
+import KeycloakProvider from "next-auth/providers/keycloak"
import CredentialsProvider from "next-auth/providers/credentials"
import { prisma } from "@lib/server/prisma"
import config from "@lib/config"
import * as crypto from "crypto"
+import {
+ isCredentialEnabled,
+ isGithubEnabled,
+ isKeycloakEnabled
+} from "./auth-props"
const credentialsOptions = () => {
const options: Record = {
@@ -33,7 +39,7 @@ const credentialsOptions = () => {
const providers = () => {
const providers = []
- if (config.github_client_id && config.github_client_secret) {
+ if (isGithubEnabled()) {
providers.push(
GitHubProvider({
clientId: config.github_client_id,
@@ -42,7 +48,41 @@ const providers = () => {
)
}
- if (config.credential_auth) {
+ if (isKeycloakEnabled()) {
+ const keycloak = KeycloakProvider({
+ clientId: config.keycloak_client_id,
+ clientSecret: config.keycloak_client_secret,
+ issuer: config.keycloak_issuer,
+ token: {
+ async request(ctx) {
+ const { client, provider, params, checks } = ctx
+ const tokens = await client.callback(
+ provider.callbackUrl,
+ params,
+ checks
+ )
+ if ("refresh_expires_in" in tokens) {
+ tokens.refresh_token_expires_in = tokens.refresh_expires_in
+ delete tokens.refresh_expires_in
+ }
+ delete tokens["not-before-policy"]
+ return { tokens }
+ }
+ }
+ })
+ const originalKeycloakProfile = keycloak.profile
+ ;(keycloak.profile = async (profile, tokens) => {
+ const originalProfile = await originalKeycloakProfile(profile, tokens)
+ const newProfile: User & { displayName?: string | null } = {
+ ...originalProfile,
+ displayName: originalProfile.name ?? null
+ }
+ return newProfile
+ }),
+ providers.push(keycloak)
+ }
+
+ if (isCredentialEnabled()) {
providers.push(
CredentialsProvider({
name: "Drift",
@@ -207,6 +247,58 @@ export const authOptions: NextAuthOptions = {
username: dbUser.username,
sessionToken: token.sessionToken
}
+ },
+ async redirect({ url, baseUrl }) {
+ if (url.startsWith(baseUrl)) return url
+ if (url.startsWith("/signedout")) {
+ const userIdFound = url.match(/userId=([^?&]+)/)
+ let userId = null
+ if (userIdFound?.length === 2) {
+ userId = userIdFound[1]
+ }
+ if (!userId) {
+ return baseUrl
+ }
+ const account = await prisma.account.findFirst({
+ where: {
+ AND: [
+ {
+ userId
+ }
+ ]
+ }
+ })
+
+ let ssoLogoutUrl = null
+ let idToken = null
+ let clientId = null
+
+ // OpenID Connect Logout
+ if (account?.provider === "keycloak") {
+ ssoLogoutUrl = `${config.keycloak_issuer}/protocol/openid-connect/logout`
+ idToken = account.id_token
+ clientId = config.keycloak_client_id
+ }
+
+ if (!ssoLogoutUrl) {
+ return baseUrl
+ }
+
+ let signoutWithRedirectUrl = `${ssoLogoutUrl}?post_logout_redirect_uri=${encodeURIComponent(
+ baseUrl
+ )}`
+
+ if (idToken) {
+ signoutWithRedirectUrl += `&id_token_hint=${idToken}`
+ } else if (clientId) {
+ signoutWithRedirectUrl += `&client_id=${clientId}`
+ }
+
+ return signoutWithRedirectUrl
+ }
+ // Allows relative callback URLs
+ if (url.startsWith("/")) return new URL(url, baseUrl).toString()
+ return baseUrl
}
}
} as const
diff --git a/src/lib/use-session-swr.ts b/src/lib/use-session-swr.ts
index c73c06a9..f86cab77 100644
--- a/src/lib/use-session-swr.ts
+++ b/src/lib/use-session-swr.ts
@@ -24,6 +24,7 @@ export function useSessionSWR(swrOpts: SWRConfiguration = {}) {
isAuthenticated: session?.user?.id ? true : isLoading ? undefined : false,
/** undefined while loading */
isAdmin:
- session?.user?.id === "admin" ? true : isLoading ? undefined : false
+ session?.user?.id === "admin" ? true : isLoading ? undefined : false,
+ userId: session?.user?.id
}
}