sectorlabs / keycloak-mock

Node.js package for mocking a Keycloak server in unit tests.

Keycloak Mock

A minimal mock for a Keycloak server to be used in unit tests.

This mock is not complete and it definitely doesn't match Keycloak completely. Improvements are welcome.

About

This does not launch an actual HTTP server. It uses nock to patch Node.js HTTP client to intercept requests.

Tested with Node.js 8.x, 10.x, 12.x, 13.x

What works

• GET /[realm]/protocol/openid-connect/certs
• GET /[realm]/protocol/openid-connect/userinfo
• GET /admin/realms/[realm]/users
• GET /admin/realms/[realm]/users?username=myusername
• POST /[realm]/protocol/openid-connect/token
• GET /admin/realms/[realm]/users/[userid]
• DELETE /admin/realms/[realm]/users/[userid]
• POST /admin/realms/[realm]/users

Usage

Basic

import * as KeycloakMock from "keycloak-node-mock";

const keycloak = await KeycloakMock.createMockInstance({
    authServerURL: "https://myserver.com/auth",
    realm: "myrealm",
    clientID: "client-1",
    clientSecret: "test",
});

// all requests to `https://myserver.com/auth` will now be
// intercepted and replied to
const mock = KeycloakMock.activateMock(keycloak);

// create a user and a token for it
const user = keycloak.database.createUser({
    name: "test",
    email: "[email protected]", // username will be email
    credentials: [{
        value: "mypassword",
    }],
});

console.log(user.profile, user.credentials);

const token = keycloak.createBearerToken(user.profile.id);

// get active mock without a reference
const sameMock = KeycloakMock.getMock("https://myserver.com/auth");

// clear user database
mock.instance.database.clear();

// find user profile
const sameUser = mock.instance.database.findUserByID(user.profile.id);

// de-activate the mock
KeycloakMock.deactivateMock(sameMock);

Custom handlers

import * as KeycloakMock from "keycloak-node-mock";

const keycloak = await KeycloakMock.createMockInstance({
    authServerURL: "https://myserver.com/auth",
    realm: "myrealm",
    clientID: "client-1",
});

keycloak.activateMock(keycloak, {
   listCertificatesView: (instance, request) => {
       return [500, ""];
   },
   getUser: (instance, request) => {
       // might be null if not authorized
       console.log(request.user);
       return [500, ""];
   },
   deleteUser: (instance, request) => {
       return [500, ""];
   },
   getUserInfoView: (instance, request) => {
       return [500, ""];
   },
   listUsers: (instance, request) => {
       return [500, ""];
   },
   createTokenView: (instance, request, body) => {
       return [500, ""];
   },
   createUserView: (instance, request, body) => {
       return [500, ""];
   },
});

keycloak-mock's Issues

Undeclared dependency on qs

The package seems to have an undeclared dependency on qs. This is the output when running it (with Node, yarn, and TypeScript in my case):

keycloak-mock tried to access qs, but it isn't declared in its dependencies; this makes the require call ambiguous and unsound.

    Required package: qs (via "qs")
    Required by: keycloak-mock@npm:1.0.10 (via C:\ ... \dev\idea\portal-backend\.yarn\cache\keycloak-mock-npm-1.0.10-dc08d6d3e1-df9b2163a8.zip\node_modules\keycloak-mock\dist\)

    Require stack:
      .yarn/cache/keycloak-mock-npm-1.0.10-dc08d6d3e1-df9b2163a8.zip/node_modules/keycloak-mock/dist/mock.js
      .yarn/cache/keycloak-mock-npm-1.0.10-dc08d6d3e1-df9b2163a8.zip/node_modules/keycloak-mock/dist/index.js
      src/test/health.test.ts

      15767 |     enumerable: false
      15768 |   };
    > 15769 |   return Object.defineProperties(new Error(message), {
            |                                  ^
      15770 |     code: { ...propertySpec,
      15771 |       value: code
      15772 |     },

      at internalTools_makeError (.pnp.js:15769:34)
      at resolveToUnqualified (.pnp.js:16734:23)
      at resolveRequest (.pnp.js:16826:29)
      at Object.resolveRequest (.pnp.js:16904:26)

Support for roles in bearer tokens

Hi,

We use keycloak-connect and protect routes using specific roles using the .protect() method. E.g.:

router.get('/admin', keycloak.protect('admin'), function (req, res, next) { ... }));

AFAIK we cannot setup roles right now. So whenever we create a token with MockInstance.createBearerToken() we get a 403 for the example above.

In order to support this we need the bearer token to include something like:

 return jwt.sign(
    {
      ...
      resource_access: { 'my-admin-client-id': { roles: ['admin'] } },
    },
    options.key.toPEM(true),
    { ... }
  );

An easy solution could be to accept a generic object with additional properties we wish the bearer token to have.

Another solution could be to add support for roles with database.createUser()?

Would you accept a PR for the 1st solution?

support audience for access token

Hi and thank you for this library!

We validate the audience (aud). E.g.:

const Keycloak = require('keycloak-connect');

const kcConfig = {
  realm: 'test',
  'bearer-only': true,
  'auth-server-url': 'http://localhost:8080/auth/',
  resource: 'test-api',
  'verify-token-audience': true,
};

const keycloak = new Keycloak({}, kcConfig);

As far as I can tell there is no way to mock an access token with aud right?

https://github.com/SectorLabs/keycloak-mock/blob/master/lib/createBearerToken.ts#L21-L40

/users/:id returned the requester profile not the user corresponding to the id

I navigated through the code and couldn't help but notice those lines

const getUser: ViewFn = (instance, request) => {
  const { user: requestUser } = request;
  if (!requestUser) {
    return [403, "Access denied"];
  }

  return [
    200,
    {
      ...requestUser.profile,
      // TODO: make these configurable
      disableableCredentialTypes: ["password"],

...

So this means, the user returned is always the one who made the request, not the one corresponding to id in request param.

It should be the user in the databases, no ?
Otherwise its useless to have mocked this method.