diff --git a/README.md b/README.md index 2292ab4..b82f6ec 100644 --- a/README.md +++ b/README.md @@ -181,6 +181,12 @@ Finally, you may choose to overwrite some configuration defaults. > In lieu of a user session, a helper instance _could_ store the authorization state in a local variable and share it between users of the instance. Currently, this is not supported, because the primary audience for the library is thought to be a typical web application with unique user accounts. +* `authorizationId` + + The helper instance saves the authorization state under a key in the session object. By default, if no input is provided, the key is generated randomly based on the current timestamp. If `authorizationId` is defined, it's value is used to generate the key. Doing so allows different helper instances to share an authorization. + + > In order to scale an application horizontally, while using a shared session store, the key, under which the authorization state is stored, can be controlled, so that an authorization is available throughout instances of the application running in parallel. If `authorizationId` is not set, a random key is generated for each helper instance. + * `customize` You can customize the default behavior of the Issuer and Client classes and their respective instances as described in [Customizing](https://github.com/panva/node-openid-client/tree/master/docs#customizing) section of the openid-client documentation. For example: diff --git a/docs/README.md b/docs/README.md index 17f4fb9..8386908 100644 --- a/docs/README.md +++ b/docs/README.md @@ -50,6 +50,7 @@ Represents an `openid-client-helper` instance. | [param0.resources] | object | { 'https://': { scope: '*' } } | A set of resources associated with resource specific scope(s). Each resource key is, generally, to comply with the proposed [Resource Parameter](https://tools.ietf.org/html/draft-ietf-oauth-resource-indicators-08#section-2) definition, as it may be used as the resource indicator in systems that adopt the draft. The resource keys will be compared against the URI in requests to a protected API resource, and the key matching the left part of the URI the most will be used to retrieve corresponding access token. | | [param0.useMasterAccessToken] | boolean | false | Indicates whether or not the "master" access token, the one associated with scopes approved by the resource owner, is to be used if a resource specific access token cannot be obtained. Setting this to `true` is not normally recommended, for it leads to use of an access token that is not audience restricted. | | [param0.sessionKey] | string | "session" | The key identifying the session object attached to requests. | +| [param0.authorizationId] | string | | Identifier for the authorization state saved in the session object, so that an authorization could be shared between the helper instances and used for horizontal scaling. | | [param0.useResourceIndicators] | boolean | false | Indicates whether [Resource Indicators for OAuth 2.0](https://tools.ietf.org/html/draft-ietf-oauth-resource-indicators-08) are supported by the authorization server. | | [param0.customize] | function | | A function to modify openid-client defaults using its [Customizing](https://github.com/panva/node-openid-client/tree/master/docs#customizing) means. The function will be sent the `custom` options object and the `Issuer` constructor. When an `issuer` or `client` instance is created, it will be provided as a parameter along with the `custom` object. This means that the `customize` function should check for presence of the `Issuer`, `issuer`, or/and `client` parameters, if those were to be modified. | diff --git a/lib/index.js b/lib/index.js index b01378c..45b0daf 100644 --- a/lib/index.js +++ b/lib/index.js @@ -54,6 +54,7 @@ const { * Setting this to `true` is not normally recommended, * for it leads to use of an access token that is not audience restricted. * @param {string} [param0.sessionKey=session] The key identifying the session object attached to requests. + * @param {string} [param0.authorizationId] Identifier for the authorization state saved in the session object, so that an authorization could be shared between the helper instances and used for horizontal scaling. * @param {boolean} [param0.useResourceIndicators=false] Indicates whether [Resource Indicators for OAuth 2.0]{@link https://tools.ietf.org/html/draft-ietf-oauth-resource-indicators-08} * are supported by the authorization server. * @param {function} [param0.customize] A function to modify openid-client defaults using its [Customizing]{@link https://github.com/panva/node-openid-client/tree/master/docs#customizing} means. @@ -75,6 +76,7 @@ module.exports = function ({ }, useMasterAccessToken = false, sessionKey = 'session', + authorizationId, useResourceIndicators = false, customize }) { @@ -105,7 +107,7 @@ module.exports = function ({ const hashes = crypto.getHashes() /** - * Unique identifier for this authorization in session. + * Identifier for this authorization in session. Base on custom data or generate randomly. */ const authorizationKey = crypto.createHash( hashes @@ -114,7 +116,7 @@ module.exports = function ({ return hash.match(/^sha1$|^sha256$/) }) || hashes[hashes.length - 1] ) - .update((new Date()).valueOf().toString()) + .update(authorizationId || (new Date()).valueOf().toString()) .digest('base64') const helper = {