Fastify passport with v6

[moeriki]

Hi all!

I've been trying to make v6 work with Fastify Passport without success.

Code

import fastifyPassport, { type Strategy } from "@fastify/passport";
import { fastify } from "fastify";
import { discovery } from "openid-client";
import { Strategy as OpenidStrategy } from "openid-client/passport";

const client = await discovery(
  new URL(config.openId.issuer),
  config.openId.clientId,
  config.openId.clientSecret,
);

const strategy = new OpenidStrategy(
  {
    callbackURL: config.openId.callbackUri,
    config: client,
    scope: "openid",
  },
  (token, callback) => {
    // No matter, execution never arrives here
    callback(null);
  },
);

strategy.currentUrl = function () {
  return new URL(config.openId.callbackUri);
};

// Type-cast `passport.Strategy` to `fastify-passport.Strategy`
const openidStrategy = strategy as unknown as Strategy;

const app = fastify()
  .register(fastifyPassport.initialize())
  .register(fastifyPassport.secureSession())
  .get("/auth/connect/openid", fastifyPassport.authenticate(openidStrategy))
  .get(
    "/auth/connect/openid/callback",
    fastifyPassport.authenticate(openidStrategy, {
      failureRedirect: "/unauthorized",
      successRedirect: "/",
    }),
  );

The conversion was quite fine but but now I can't get it to work.

Issue

Currently it goes into an infinite redirection loop from /openid ➡️ Login ➡️ /openid/callback ➡️ Login.

Potential issue

I used to have this config new issuer.Client({ response_types: ['code'] }). I don't find this in the docs nor in the types anymore.

Not an issue

The need to overwrite strategy.currentUrl is rather strange (as brought up in #714) This wasn't necessary before. Why the need to specify the callback URL again? This did fix the first issue I ran into.

Worth mentioning

• Code has been edited and well abbreviated (trying to keep only the relevant bits)
• The front-end runs on a Vite App with SSL and a proxy to a separate Node.js back-end running fastify and openid-client.
• Fastify Passport has an integration test suite for openid-client. They haven't updated it to v6 yet :) I tried but failed to make a sensible PR there.

Closing

If anyone else is using a similar setup and managed to make it work do spill the beans. Otherwise I'll probably wait for Fastify Passport to update their integrations tests and see if that helps me :)

[panva]

currentUrl is not the same as your callbackUrl which is what you're currently overloading with. It's meant to return the current url incl. the query component to which the AS returned the end-user.

[moeriki]

Yeah that makes sense. I added it based on #714. Without it I got this error in the callback.

"AADSTS500112: The reply address 'http://127.0.0.1:1659/auth/connect/openid/callback' does not match the reply address 'https://my-app-local.my-company.com:1651/auth/connect/openid/callback'

I guess it has something to do with our proxy setup. Still somewhat strange as this wasn't needed before. But this works!

strategy.currentUrl = function (request) {
	const callbackUrl = new URL(config.openId.callbackUri);
	const currentUrl = OpenidStrategy.prototype.currentUrl.call(this, request);
	currentUrl.host = callbackUrl.host;
	currentUrl.protocol = callbackUrl.protocol;
	return currentUrl;
};

Thanks!