<commit_before>[![Build Status](https://travis-ci.org/gambol99/keycloak-proxy.svg?branch=master)](https://travis-ci.org/gambol99/keycloak-proxy)
[![GoDoc](http://godoc.org/github.com/gambol99/keycloak-proxy?status.png)](http://godoc.org/github.com/gambol99/keycloak-proxy)

### **Keycloak Proxy**
----

  - Supports role based uri controls
  - Websocket connection upgrading
  - Token claim matching for additional ACL controls
  - Custom claim injections into authenticated requests
  - Stateless offline refresh tokens with optional predefined session limits
  - TLS and mutual TLS support
  - JSON field bases access logs
  - Custom Sign-in and access forbidden pages

----

Keycloak-proxy is a proxy service which at the risk of stating the obvious integrates with the [Keycloak](https://github.com/keycloak/keycloak) authentication service. Although technically the service has no dependency on Keycloak itself and would quite happily work with any OpenID provider. The service supports both access tokens in browser cookie or bearer tokens.

```shell
[jest@starfury keycloak-proxy]$ bin/keycloak-proxy help
NAME:
   keycloak-proxy - is a proxy using the keycloak service for auth and authorization

USAGE:
   keycloak-proxy [global options] command [command options] [arguments...]

VERSION:
   v1.0.5

AUTHOR(S):
   Rohith <<EMAIL>>

COMMANDS:
GLOBAL OPTIONS:
--config                                                the path to the configuration file for the keycloak proxy
--listen "127.0.0.1:3000"                               the interface the service should be listening on
--client-secret                                         the client secret used to authenticate to the oauth server
--client-id                                             the client id used to authenticate to the oauth serves
--discovery-url                                         the discovery url to retrieve the openid configuration
--upstream-url "http://127.0.0.1:8081"                  the url for the upstream endpoint you wish to proxy to
--revocation-url "/oauth2/revoke"                       the url for the revocation endpoint to revoke refresh token, not all providers support the revocation_endpoint
--upstream-keepalives                                   enables or disables the keepalive connections for upstream endpoint (defaults true)
--encryption-key                                        the encryption key used to encrpytion the session state
--secure-cookie                                         enforces the cookie to be secure, default to true
--store-url                                             the store url to use for storing the refresh tokens, i.e. redis://127.0.0.1:6379, file:///etc/tokens.file
--no-redirects                                          do not have back redirects when no authentication is present, simple reply with 401 code
--redirection-url                                       the redirection url, namely the site url, note: /oauth will be added to it
--hostname [--hostname option --hostname option]        a list of hostnames the service will respond to, defaults to all
--tls-cert                                              the path to a certificate file used for TLS
--tls-private-key                                       the path to the private key for TLS support
--tls-ca-certificate                                    the path to the ca certificate used for mutual TLS
--skip-upstream-tls-verify                              whether to skip the verification of any upstream TLS (defaults to true)
--scope [--scope option --scope option]                 a variable list of scopes requested when authenticating the user
--claim [--claim option --claim option]                 a series of key pair values which must match the claims in the token present e.g. aud=myapp, iss=http://example.com etcd
--resource [--resource option --resource option]        a list of resources 'uri=/admin|methods=GET|roles=role1,role2'
--signin-page                                           a custom template displayed for signin
--forbidden-page                                        a custom template used for access forbidden
--tag [--tag option --tag option]                       a keypair tag which is passed to the templates when render, i.e. title='My Page',site='my name' etc
--cors-origins [--cors-origins option --cors-origins option]      a set of origins to add to the CORS access control (Access-Control-Allow-Origin)
--cors-methods [--cors-methods option --cors-methods option]      the method permitted in the access control (Access-Control-Allow-Methods)
--cors-headers [--cors-headers option --cors-headers option]      a set of headers to add to the CORS access control (Access-Control-Allow-Headers)
--cors-exposes-headers [--cors-exposes-headers option --cors-exposes-headers option]   set the expose cors headers access control (Access-Control-Expose-Headers)
--cors-max-age "0"                                      the max age applied to cors headers (Access-Control-Max-Age)
--cors-credentials                                      the credentials access control header (Access-Control-Allow-Credentials)
--enable-security-filter                                enables the security filter handler
--skip-token-verification                               testing purposes ONLY, the option allows you to bypass the token verification, expiration and roles are still enforced
--proxy-protocol                                        switches on proxy protocol support on the listen (not supported yet)
--offline-session                                       enables the offline session of tokens via offline access (defaults false)
--json-logging                                          switch on json logging rather than text (defaults true)
--log-requests                                          switch on logging of all incoming requests (defaults true)
--verbose                                               switch on debug / verbose logging
--help, -h                                              show help
--version, -v                                           print the version

```

#### **Configuration**

The configuration can come from a yaml/json file and or the command line options (note, command options have a higher priority and will override any options referenced in a config file)

```YAML
# is the url for retrieve the openid configuration - normally the <server>/auth/realm/<realm_name>
discovery-url: https://keycloak.example.com/auth/realms/<REALM_NAME>
# the client id for the 'client' application
client-id: <CLIENT_ID>
# the secret associated to the 'client' application
client-secret: <CLIENT_SECRET>
# the interface definition you wish the proxy to listen, all interfaces is specified as ':<port>'
listen: 127.0.0.1:3000
# whether to enable refresh tokens
enable-refresh-token: true
# the location of a certificate you wish the proxy to use for TLS support
tls-cert:<commit_msg>- updating the readme with the correct help<commit_after>[![Build Status](https://travis-ci.org/gambol99/keycloak-proxy.svg?branch=master)](https://travis-ci.org/gambol99/keycloak-proxy)
[![GoDoc](http://godoc.org/github.com/gambol99/keycloak-proxy?status.png)](http://godoc.org/github.com/gambol99/keycloak-proxy)

### **Keycloak Proxy**
----

  - Supports role based uri controls
  - Websocket connection upgrading
  - Token claim matching for additional ACL controls
  - Custom claim injections into authenticated requests
  - Stateless offline refresh tokens with optional predefined session limits
  - TLS and mutual TLS support
  - JSON field bases access logs
  - Custom Sign-in and access forbidden pages

----

Keycloak-proxy is a proxy service which at the risk of stating the obvious integrates with the [Keycloak](https://github.com/keycloak/keycloak) authentication service. Although technically the service has no dependency on Keycloak itself and would quite happily work with any OpenID provider. The service supports both access tokens in browser cookie or bearer tokens.

```shell
[jest@starfury keycloak-proxy]$ bin/keycloak-proxy help
NAME:
   keycloak-proxy - is a proxy using the keycloak service for auth and authorization

USAGE:
   keycloak-proxy [global options] command [command options] [arguments...]
   
VERSION:
   v1.0.5
   
AUTHOR(S):
   Rohith <<EMAIL>> 
   
COMMANDS:
GLOBAL OPTIONS:
   --config 										the path to the configuration file for the keycloak proxy
   --listen "127.0.0.1:3000"								the interface the service should be listening on
   --client-secret 									the client secret used to authenticate to the oauth server
   --client-id 										the client id used to authenticate to the oauth serves
   --discovery-url 									the discovery url to retrieve the openid configuration
   --scope [--scope option --scope option]						a variable list of scopes requested when authenticating the user
   --idle-duration "0"									the expiration of the access token cookie, if not used within this time its removed
   --redirection-url 									redirection url for the oauth callback url (/oauth is added)
   --upstream-url "http://127.0.0.1:8081"						the url for the upstream endpoint you wish to proxy to
   --revocation-url "/oauth2/revoke"							the url for the revocation endpoint to revoke refresh token
   --store-url 										url for the storage subsystem, e.g redis://127.0.0.1:6379, file:///etc/tokens.file
   --upstream-keepalives								enables or disables the keepalive connections for upstream endpoint
   --enable-refresh-tokens								enables the handling of the refresh tokens
   --secure-cookie									enforces the cookie to be secure, default to true
   --cookie-access-name "kc-access"							the name of the cookie use to hold the access token
   --cookie-refresh-name "kc-state"							the name of the cookie used to hold the encrypted refresh token
   --encryption-key 									the encryption key used to encrpytion the session state
   --no-redirects									do not have back redirects when no authentication is present, 401 them
   --hostname [--hostname option --hostname option]					a list of hostnames the service will respond to, defaults to all
   --tls-cert 										the path to a certificate file used for TLS
   --tls-private-key 									the path to the private key for TLS support
   --tls-ca-certificate 								the path to the ca certificate used for mutual TLS
   --skip-upstream-tls-verify								whether to skip the verification of any upstream TLS (defaults to true)
   --match-claims [--match-claims option --match-claims option]				keypair values for matching access token claims e.g. aud=myapp, iss=http://example.*
   --add-claims [--add-claims option --add-claims option]				retrieve extra claims from the token and inject into headers, e.g given_name -> X-Auth-Given-Name
   --resource [--resource option --resource option]					a list of resources 'uri=/admin|methods=GET|roles=role1,role2'
   --signin-page 									a custom template displayed for signin
   --forbidden-page 									a custom template used for access forbidden
   --tag [--tag option --tag option]							keypair's passed to the templates at render,e.g title='My Page'
   --cors-origins [--cors-origins option --cors-origins option]				list of origins to add to the CORE origins control (Access-Control-Allow-Origin)
   --cors-methods [--cors-methods option --cors-methods option]				the method permitted in the access control (Access-Control-Allow-Methods)
   --cors-headers [--cors-headers option --cors-headers option]				a set of headers to add to the CORS access control (Access-Control-Allow-Headers)
   --cors-exposes-headers [--cors-exposes-headers option --cors-exposes-headers option]	set the expose cors headers access control (Access-Control-Expose-Headers)
   --cors-max-age "0"									the max age applied to cors headers (Access-Control-Max-Age)
   --cors-credentials									the credentials access control header (Access-Control-Allow-Credentials)
   --headers [--headers option --headers option]					Add custom headers to the upstream request, key=value
   --enable-security-filter								enables the security filter handler
   --skip-token-verification								TESTING ONLY; bypass's token verification, expiration and roles enforced
   --offline-session									enables the offline session of tokens via offline access (defaults false)
   --json-logging									switch on json logging rather than text (defaults true)
   --log-requests									switch on logging of all incoming requests (defaults true)
   --verbose										switch on debug / verbose logging
   --help, -h										show help
   --version, -v									print the version

```

#### **Configuration**

The configuration can come from a yaml/json file and or the command line options (note, command options have a higher priority and will override any options referenced in a config file)

```YAML
# is the url for retrieve the openid configuration - normally the <server>/auth/realm/<realm_name>
discovery-url: https://keycloak.example.com/auth/realms/<REALM_NAME>
# the client id for the 'client' application
client-id: <CLIENT_ID>
# the secret associated to the 'client' application
client-secret: <CLIENT_SECRET>
# the interface definition you wish the proxy to listen, all interfaces is specified as ':<port>'
listen: 127.0.0.1:3000
# whether to enable refresh tokens
enable-refresh-token: true
# the location of a certificate you wish the proxy to use for TLS support
tls-cert:
{'fraction_non_alphanumeric': 0.07857089911793047, 'fraction_numerical': 0.00867244829886591, 'mean_word_length': 2.4845041322314048, 'pattern_counts': {'":': 0, '<': 19, '<?xml version=': 0, '>': 20, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 8, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 48, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '999258', 'n_tokens_mistral': 3803, 'n_tokens_neox': 3370, 'n_words': 1441}