where-server-auth-resource

where-server-auth-module. Verifies access tokens and acts as an OAuth 2.0 Resource Server.

Installation

npm i @where-org/where-server-auth-resource

Authentication

This module provides verify only. It acts as an OAuth 2.0 Resource Server: it validates access tokens issued by an external authorization server (e.g. Keycloak) against that server's published JWKS. There is no login or refresh.

verify accepts the Authorization: Bearer <token> header, checks the token signature against the JWKS, and validates the issuer, audience, and allowed algorithms. On success it returns the token's sub and scope.

Configuration

Add the following to config/server-app.yaml.

• [...] - placeholder, replace with your value
• ${VAR:-default} - environment variable with default value

[APP_NAME]:

  auth:
    module: '@where-org/where-server-auth-resource'
    credential:
      jwksUri   : ${JWKS_URI}
      issuer    : ${ISSUER}
      audience  : ${AUDIENCE}
      algorithms: [RS256, ES256]

| Field | Description | | ------------ | -------------------------------------------------------------------------------------------------------------- | | jwksUri | JWKS endpoint of the authorization server. Public keys are fetched from here to verify token signatures. | | issuer | Expected iss claim. Tokens from a different issuer are rejected. | | audience | Expected aud claim. Tokens for a different audience are rejected. | | algorithms | Allowed signing algorithms. Tokens signed with any other algorithm are rejected. |