Product
Introducing SSO
Streamline your login process and enhance security by enabling Single Sign-On (SSO) on the Socket platform, now available for all customers on the Enterprise plan, supporting 20+ identity providers.
@maslick/brauzie
Advanced tools
Readme
Often times when debugging security for your web-applications you need to quickly get the access token from your Identity provider (e.g. Keycloak) and fire a GET/POST request to your backend server using curl
or httpie
. Some people use Postman, some do it manually. Both approaches are time-consuming and nerve-wracking.
Brauzie was designed with an idea of a fast and simple CLI tool for fetching access tokens for Keycloak public
and confidential
clients. It also frees you from the necessity of copy/pasting/decoding your JWT tokens on https://jwt.io.
public
and confidential
client types~/.brauzie/jwt.json
~/.brauzie/id-token.json
npm i -g @maslick/brauzie
For this to work you will need to register a new public
client in Keycloak.
Then set your configuration via environment variables:
export BRAUZIE_KC_URL=https://auth.maslick.ru
export BRAUZIE_REALM=brauzie
export BRAUZIE_CLIENT_ID=web
Then you can login/logout:
brauzie login
brauzie logout
Create a new or use the existing confidential
client. Make sure to toggle the Direct Access Grants Enabled switch to ON
.
Then set the respective environment variables:
export BRAUZIE_KC_URL=https://auth.maslick.ru
export BRAUZIE_REALM=brauzie
export BRAUZIE_CLIENT_ID=oidc-k8s
export BRAUZIE_CLIENT_SECRET=aaaaa-bbbbb-ccccc-ddddd-eeeee
export BRAUZIE_USERNAME=user
export BRAUZIE_PASSWORD=password
Now you can login/logout:
brauzie login --direct-grant
brauzie logout
Brauzie uses the Authorization Code flow (see the OAuth2.0 specs).
After you execute the login
command, Brauzie will open up a browser window where you will have to login to your OIDC public client with username/password. Then it will exchange the authorization_code
for the JWT token and save it to ~/.brauzie/jwt.json
:
cat ~/.brauzie/jwt.json
{
"access_token": "xxxxx.yyyyy.zzzzz",
"expires_in": 300,
"refresh_expires_in": 1800,
"refresh_token": "zzzzz.yyyyy.xxxxx",
"token_type": "bearer",
"id_token": "aaaaa.bbbbb.ccccc",
"not-before-policy": 0,
"session_state": "620a5ee7-1596-4669-ac7a-115738f2210c",
"scope": "openid profile email"
}
Unless --quite
is specified, Brauzie will output the access_token
to stdout.
It will also put the decoded id_token
to ~/.brauzie/id-token.json
:
cat ~/.brauzie/id-token.json
{
"jti": "fffd0c04-f971-4328-8116-fa4cbabd4978",
"exp": 1561839325,
"nbf": 0,
"iat": 1561839025,
"iss": "https://auth.maslick.ru/auth/realms/brauzie",
"aud": "web",
"sub": "3f6d7531-cf67-4702-a62a-8efcf914d904",
"typ": "ID",
"azp": "web",
"auth_time": 1561839025,
"session_state": "c298f25b-60ac-4e55-825a-2a66cbfa0cfc",
"acr": "1",
"email_verified": true,
"name": "Admin Adminović",
"groups": [
"/cluster-admins"
],
"preferred_username": "admin",
"given_name": "Admin",
"family_name": "Adminović",
"email": "admin@admin.si"
}
Logout will invalidate the current user session and delete the contents of the ~/.brauzie/
directory.
For some applications browser interactions may become a burden (CLI tools, automation scripts, etc.) For this you could utilize the Direct Access Grants flow. This requires a Keycloak client of type confidential
. Confidential clients are a mix of public
and bearer-only
. Just like bearer-only
clients they contain a client-secret
, and like public
clients they can issue JWT tokens.
So instead of using the browser (logging in) you can specify BRAUZIE_CLIENT_SECRET
, BRAUZIE_USERNAME
and BRAUZIE_PASSWORD
and just issue:
brauzie login --direct-grant
export TOKEN=`brauzie login`
curl -H "Authorization: Bearer $TOKEN" htts://example.com
cat ~/.brauzie | jq -r '.access_token'
cat ~/.brauzie | jq -r '.refresh_token'
TOKEN=$(cat ~/.brauzie/jwt.json | jq -r '.access_token')
http http://httpbin.org/get "Authorization: Bearer $TOKEN"
echo $(cat ~/.brauzie/id-token.json | jq -r '.name')
cluster-admins
or cluster-users
.FAQs
Awesome CLI for fetching JWT tokens for public OAuth2.0 clients
The npm package @maslick/brauzie receives a total of 26 weekly downloads. As such, @maslick/brauzie popularity was classified as not popular.
We found that @maslick/brauzie demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Streamline your login process and enhance security by enabling Single Sign-On (SSO) on the Socket platform, now available for all customers on the Enterprise plan, supporting 20+ identity providers.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.