akunzai / mikrotik-hotspot-oauth

Keycloak Radius Hotspot

Setup social and other Oauth/Saml integration with Keycloak Radius embedded server

Requirements

• Node.js
• pnpm

Getting Started

# activate the pnpm package manager
corepack enable

# install npm packages
pnpm install

# watch and serve a dev server at http://localhost:5173/login.html
# put your keycloak.json in ./public/
pnpm start

# build the project in production mode. The build artifacts will be stored in the `dist/` directory
pnpm build

How Keycloak Radius Hotspot works

1. Authorization through Keycloak occurs by OpenID Connect.
2. User selects on the login page the identity provider through which he wants to log in
3. The result of a successful authorization is a JWT that contains a temporary session key.
4. With this key, the User is authorized through Radius Server.
5. Radius Server checks if this key is in the user session. And whether it was used.
6. Radius Server successfully authorizing the user

Connection Schema

Cloud connection (Better to Use Radsec)

Proxy connection

Setup, build and configure HotSpot page for Social Login

1. Create Realm
2. Create Radius Client
3. Create OpenId client
4. Setting your Hotspot DNS in "Valid Redirect URIs" and "Web Origins"
5. Add "Radius Session Password" Mapper
6. Download keycloak.json

Setup Mikrotik

1. Download the hostpot.zip from the latest release, unzip and upload the login.html file and assets folder into /hotspot folder on device via
   • web UI
   • scp
   • ftp
   • winbox
2. Download keycloak.json
3. upload keycloak.json into /hotspot folder on device
4. update Walled Garden. Add your keycloak host

Facebook Login example

1. Install Keycloak with embedded Radius Server

2. install ngrok. Register ngrok

   ./ngrok authtoken <YOUR TOKEN>

3. start ngrok

   ./ngrok http 8090

   

4. open keycloak goto realm and add Facebook Identity Provider

5. Copy Redirect URI

6. goto https://developers.facebook.com/ and create a new application

7. Insert Redirect URI from Step 7

8. Get App Id and Secret from application (Settings->basic)

9. back to Keycloak and set this App Id and Secret

10. add facebook hosts to Walled Garden

    /ip hotspot walled-garden
    add comment=facebook dst-host=facebook.*
    add comment=facebook dst-host=*.facebook.*
    add comment=facebook dst-host=*.fbcdn.*
    add comment=facebook dst-host=*akamai*
    add comment=facebook dst-host=*atdmt*
    add comment=facebook dst-host=*fbsbx*
    add comment=common dst-host=www.google-analytics.com

11. open hotspot page

mikrotik-hotspot-oauth's Issues

TypeError: Cannot read properties of undefined (reading 'importKey')

• the jose cannot working without HTTPS
• it works only on localhost

steps to reproduce

sudo echo "hotspot.dev.local 127.0.0.1" >> /etc/hosts
open http://hotspot.dev.local:5173/login.html