Opinion: Auth0 2026 Is Too Expensive – Keycloak 24 Is Better for Self-Hosted Auth

const axios = require('axios');
const { KeycloakAdminClient } = require('@keycloak/keycloak-admin-client');
const dotenv = require('dotenv');
dotenv.config();

// Configuration from environment variables
const AUTH0_DOMAIN = process.env.AUTH0_DOMAIN;
const AUTH0_MGMT_TOKEN = process.env.AUTH0_MGMT_TOKEN;
const KEYCLOAK_BASE_URL = process.env.KEYCLOAK_BASE_URL;
const KEYCLOAK_REALM = process.env.KEYCLOAK_REALM;
const KEYCLOAK_ADMIN_USER = process.env.KEYCLOAK_ADMIN_USER;
const KEYCLOAK_ADMIN_PASS = process.env.KEYCLOAK_ADMIN_PASS;

// Validate required environment variables
const requiredEnvVars = [
  'AUTH0_DOMAIN',
  'AUTH0_MGMT_TOKEN',
  'KEYCLOAK_BASE_URL',
  'KEYCLOAK_REALM',
  'KEYCLOAK_ADMIN_USER',
  'KEYCLOAK_ADMIN_PASS'
];
requiredEnvVars.forEach(varName => {
  if (!process.env[varName]) {
    throw new Error(`Missing required environment variable: ${varName}`);
  }
});

// Initialize Keycloak Admin Client
const kcAdminClient = new KeycloakAdminClient({
  baseUrl: KEYCLOAK_BASE_URL,
  realmName: 'master'
});

/**
 * Fetches all users from Auth0 with pagination
 * @returns {Promise} Array of Auth0 user objects
 */
async function fetchAuth0Users() {
  const users = [];
  let page = 0;
  const perPage = 100;
  let hasMore = true;

  while (hasMore) {
    try {
      const response = await axios.get(`https://${AUTH0_DOMAIN}/api/v2/users`, {
        headers: {
          Authorization: `Bearer ${AUTH0_MGMT_TOKEN}`
        },
        params: {
          page,
          per_page: perPage,
          include_totals: true
        }
      });

      users.push(...response.data.users);
      hasMore = response.data.start + response.data.length < response.data.total;
      page++;
    } catch (error) {
      console.error(`Failed to fetch Auth0 users page ${page}:`, error.response?.data || error.message);
      // Retry once on rate limit
      if (error.response?.status === 429) {
        await new Promise(resolve => setTimeout(resolve, 1000));
        continue;
      }
      throw error;
    }
  }

  return users;
}

/**
 * Creates a Keycloak user from Auth0 user data
 * @param {Object} auth0User - Auth0 user object
 */
async function createKeycloakUser(auth0User) {
  try {
    // Map Auth0 fields to Keycloak fields
    const keycloakUser = {
      username: auth0User.nickname || auth0User.email,
      email: auth0User.email,
      emailVerified: auth0User.email_verified || false,
      enabled: true,
      firstName: auth0User.given_name || '',
      lastName: auth0User.family_name || '',
      credentials: auth0User.password_hash ? [{
        type: 'password',
        value: auth0User.password_hash,
        temporary: false
      }] : [],
      attributes: {
        auth0_id: [auth0User.user_id]
      }
    };

    await kcAdminClient.users.create(keycloakUser);
    console.log(`Created Keycloak user for ${auth0User.email}`);
  } catch (error) {
    console.error(`Failed to create Keycloak user for ${auth0User.email}:`, error.response?.data || error.message);
    // Log failed users to file for manual retry
    require('fs').appendFileSync('failed_migrations.txt', `${auth0User.user_id}\n`);
  }
}

async function main() {
  try {
    // Authenticate to Keycloak
    await kcAdminClient.auth({
      username: KEYCLOAK_ADMIN_USER,
      password: KEYCLOAK_ADMIN_PASS,
      grantType: 'password',
      clientId: 'admin-cli'
    });

    console.log('Authenticated to Keycloak successfully');

    // Fetch Auth0 users
    const auth0Users = await fetchAuth0Users();
    console.log(`Fetched ${auth0Users.length} users from Auth0`);

    // Migrate each user
    for (const user of auth0Users) {
      await createKeycloakUser(user);
      // Rate limit to avoid Keycloak overload
      await new Promise(resolve => setTimeout(resolve, 100));
    }

    console.log('Migration complete');
  } catch (error) {
    console.error('Migration failed:', error.message);
    process.exit(1);
  }
}

// Run migration
main();

package com.example.keycloak.authenticators;

import org.keycloak.authentication.AuthenticationFlowContext;
import org.keycloak.authentication.Authenticator;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.RealmModel;
import org.keycloak.models.UserModel;
import org.keycloak.sessions.AuthenticationSessionModel;
import org.keycloak.http.HttpRequest;
import org.keycloak.common.util.Retry;

import java.net.InetAddress;
import java.net.UnknownHostException;
import java.util.List;
import java.util.stream.Collectors;

/**
 * Custom Keycloak 24 authenticator that whitelists IP ranges for auth flows.
 * Configured via realm attributes: ip.whitelist = comma-separated CIDR ranges
 */
public class IPWhitelistAuthenticator implements Authenticator {

    public static final String IP_WHITELIST_ATTR = \"ip.whitelist\";
    public static final String FORWARDED_FOR_HEADER = \"X-Forwarded-For\";

    private final KeycloakSession session;

    public IPWhitelistAuthenticator(KeycloakSession session) {
        this.session = session;
    }

    @Override
    public void authenticate(AuthenticationFlowContext context) {
        HttpRequest request = session.getContext().getHttpRequest();
        String clientIp = extractClientIp(request);

        if (clientIp == null) {
            context.failure(AuthenticationFlowError.INVALID_CREDENTIALS, null);
            return;
        }

        RealmModel realm = context.getRealm();
        String whitelistConfig = realm.getAttribute(IP_WHITELIST_ATTR);

        if (whitelistConfig == null || whitelistConfig.isEmpty()) {
            // No whitelist configured, allow all
            context.success();
            return;
        }

        List whitelistedRanges = List.of(whitelistConfig.split(\",\"));
        boolean isAllowed = whitelistedRanges.stream()
                .anyMatch(range -> isIpInRange(clientIp, range.trim()));

        if (isAllowed) {
            context.success();
        } else {
            context.failure(AuthenticationFlowError.INVALID_CREDENTIALS, null);
            logFailedAttempt(clientIp, realm.getName());
        }
    }

    /**
     * Extracts client IP from request, handling X-Forwarded-For headers
     */
    private String extractClientIp(HttpRequest request) {
        String forwardedFor = request.getHttpHeaders().getHeaderString(FORWARDED_FOR_HEADER);
        if (forwardedFor != null && !forwardedFor.isEmpty()) {
            // Take first IP in X-Forwarded-For chain (client IP)
            return forwardedFor.split(\",\")[0].trim();
        }
        return request.getRemoteAddr();
    }

    /**
     * Checks if an IP address falls within a CIDR range
     * @param ip - IP address to check
     * @param cidr - CIDR range (e.g., 192.168.1.0/24)
     * @return true if IP is in range
     */
    private boolean isIpInRange(String ip, String cidr) {
        try {
            InetAddress address = InetAddress.getByName(ip);
            InetAddress rangeAddress = InetAddress.getByName(cidr.split(\"/\")[0]);
            int prefixLength = Integer.parseInt(cidr.split(\"/\")[1]);

            byte[] addressBytes = address.getAddress();
            byte[] rangeBytes = rangeAddress.getAddress();

            if (addressBytes.length != rangeBytes.length) {
                return false; // IPv4 vs IPv6 mismatch
            }

            int bytesToCheck = prefixLength / 8;
            int bitsToCheck = prefixLength % 8;

            // Check full bytes
            for (int i = 0; i < bytesToCheck; i++) {
                if (addressBytes[i] != rangeBytes[i]) {
                    return false;
                }
            }

            // Check remaining bits
            if (bitsToCheck > 0) {
                int mask = (0xFF << (8 - bitsToCheck)) & 0xFF;
                return (addressBytes[bytesToCheck] & mask) == (rangeBytes[bytesToCheck] & mask);
            }

            return true;
        } catch (UnknownHostException | NumberFormatException e) {
            context.getSession().getLogger().error(\"Failed to parse CIDR or IP: \" + cidr + \", \" + ip, e);
            return false;
        }
    }

    private void logFailedAttempt(String ip, String realmName) {
        session.getLogger().warn(\"IP whitelist failed: IP {} denied access to realm {}\", ip, realmName);
    }

    @Override
    public void action(AuthenticationFlowContext context) {
        // No action required for this authenticator
    }

    @Override
    public boolean requiresUser() {
        return false;
    }

    @Override
    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
        return true;
    }

    @Override
    public void setRequiredActions(KeycloakSession session, RealmModel realm, UserModel user) {
        // No required actions
    }

    @Override
    public void close() {
        // No resources to close
    }
}

const express = require('express');
const session = require('express-session');
const Keycloak = require('keycloak-connect');
const dotenv = require('dotenv');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');

dotenv.config();

const app = express();
const port = process.env.PORT || 3000;

// Security middleware
app.use(helmet());
app.use(rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100 // limit each IP to 100 requests per windowMs
}));

// Session configuration (required for Keycloak Connect)
const memoryStore = new session.MemoryStore();
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: true,
  store: memoryStore
}));

// Validate Keycloak config
const requiredKeycloakVars = ['KEYCLOAK_BASE_URL', 'KEYCLOAK_REALM', 'KEYCLOAK_CLIENT_ID', 'KEYCLOAK_CLIENT_SECRET'];
requiredKeycloakVars.forEach(varName => {
  if (!process.env[varName]) {
    throw new Error(`Missing Keycloak environment variable: ${varName}`);
  }
});

// Keycloak configuration
const keycloakConfig = {
  'realm': process.env.KEYCLOAK_REALM,
  'auth-server-url': process.env.KEYCLOAK_BASE_URL,
  'ssl-required': 'external',
  'resource': process.env.KEYCLOAK_CLIENT_ID,
  'credentials': {
    'secret': process.env.KEYCLOAK_CLIENT_SECRET
  },
  'confidential-port': 0,
  'policy-enforcer': {
    'enforcement-mode': 'PERMISSIVE'
  }
};

const keycloak = new Keycloak({ store: memoryStore }, keycloakConfig);

// Keycloak middleware
app.use(keycloak.middleware({
  logout: '/logout',
  admin: '/'
}));

// Protected route example
app.get('/api/protected', keycloak.protect(), async (req, res) => {
  try {
    // Fetch user info from Keycloak
    const userInfo = await keycloak.grantManager.userInfo(req.session['keycloak-token']);

    res.json({
      message: 'Authenticated successfully',
      user: {
        id: userInfo.sub,
        email: userInfo.email,
        name: userInfo.name,
        roles: req.session['keycloak-token'].content.realm_access.roles
      }
    });
  } catch (error) {
    console.error('Failed to fetch user info:', error.message);
    res.status(500).json({ error: 'Failed to fetch user details' });
  }
});

// Public route
app.get('/api/public', (req, res) => {
  res.json({ message: 'Public endpoint, no auth required' });
});

// Logout route
app.get('/logout', (req, res) => {
  req.session.destroy((err) => {
    if (err) {
      console.error('Failed to destroy session:', err.message);
      return res.status(500).json({ error: 'Logout failed' });
    }
    res.redirect('/');
  });
});

// Global error handler
app.use((err, req, res, next) => {
  console.error('Unhandled error:', err.message);
  res.status(500).json({ error: 'Internal server error' });
});

// Start server
app.listen(port, () => {
  console.log(`Node.js app listening on port ${port}`);
  console.log(`Protected route: http://localhost:${port}/api/protected`);
  console.log(`Public route: http://localhost:${port}/api/public`);
});

// Handle uncaught exceptions
process.on('uncaughtException', (err) => {
  console.error('Uncaught exception:', err.message);
  process.exit(1);
});

process.on('unhandledRejection', (err) => {
  console.error('Unhandled rejection:', err.message);
  process.exit(1);
});

# Helm values for Keycloak 24 metrics enablement
keycloak:
  extraEnv: |
    - name: KEYCLOAK_METRICS_ENABLED
      value: \"true\"
    - name: JAVA_OPTS_APPEND
      value: \"-Dquarkus.http.management.enabled=true\"
prometheus:
  enabled: true
  serviceMonitor:
    enabled: true
    selector:
      app: keycloak

# Velero backup schedule for Keycloak 24 PostgreSQL PVC
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: keycloak-db-backup
  namespace: velero
spec:
  schedule: \"0 2 * * *\" # Daily at 2 AM
  template:
    includedNamespaces:
      - keycloak
    includedResources:
      - persistentvolumeclaims
      - persistentvolumes
    labelSelector:
      matchLabels:
        app: keycloak
        component: db
    snapshotVolumes: true
    ttl: 168h # 7 day retention

// Enforce ABAC policy in Node.js with Keycloak 24
app.get('/api/patient-records/:state', 
  keycloak.protect('patient:read'), 
  (req, res) => {
    const userState = req.session['keycloak-token'].content.attributes.state[0];
    const requestedState = req.params.state;

    if (userState !== requestedState) {
      return res.status(403).json({ error: 'Not authorized for this state' });
    }
    // Fetch and return patient records
  });