@opuscapita/useridentity-middleware

OpusCapita UserIdentity Middlware

This module defines an express middleware providing read access to the encrypted identity token (jwt) of a user as used in OpusCapita Business Network.

Using UserIdentity Middlware

• In order to use UserIdentity Middlware in your project, you can either use it directly as an express middleware or through @opuscapita/web-init.
• For using UserIdentity Middlware directly via API, please have a look at the API documentation wiki.

For using it with express, simply do the following:

const UserIdentity = require('@opuscapita/useridentity-middleware');

const userIdentity = new UserIdentity();
const app = express();

app.use(userIdentity.middleware());

Access the data

As this middleware is intended to be used with web-init, it extends the req.opuscapita namespace adding several methods and properties.

Methods:

• req.opuscapita.userData(key = null) : object
• req.opuscapita.getTenantId() : string
• req.opuscapita.isSupplier(tenantId) : bool
• req.opuscapita.isCustomer(tenantId) : bool
• req.opuscapita.getSupplierId(tenantId) : string
• req.opuscapita.getCustomerId(tenantId) : string
• req.opuscapita.splitTenant(tenantId) : object
• req.opuscapita.customerIdToTenantId(supplierId = null) : string
• req.opuscapita.supplierIdToTenantId(customerId = null) : string

Properties:

• req.opuscapita.isAuthenticated

The method req.opuscapita.userData(key) can either be called with or without a key. If no key is passed, the whole user-data object is returned. If a key is present (can also be camel case e.g. supplierId) only the value of the key is returned. If the key was not found, the result will be null.

The special req.opuscapita.splitTenant(tenantId) tries to find out whenever the passed tenantId is a supplier or a customer ID and returns an object containing the properties supplierId and customerId. If the passed tenantId is valid, one of the properties will be filled and the other will be null. If the passed tenantId is invalid or empty, both properties will be null.

If the no identity token was present, could not be decrypted or an error occurred, the requesting client will get an HTTP 403 response.

Example user-data

{
    "sub": "[e-mail]",
    "id": "[e-mail]",
    "email": "[e-mail]",
    "phoneno": "[phone]",
    "supplierid": "mySupplier",
    "customerid": "",
    "status": "firstLogin",
    "maychangesupplier": false,
    "maychangecustomer": false,
    "languageid": "en",
    "firstname": "John",
    "lastname": "Doe",
    "mustbechanged": "",
    "roles": ["supplier-admin", "user"],
    "nonce": "b946536ab2313b11489c6c1d1f78b5da",
    "at_hash": "Yh_Rdj-erYaD0N0zhP1PBA",
    "rt_hash": "uQLs-2iM0zcxeMIcMKbXRA",
    "sid": "162fc78b-ea7e-4816-ae12-dfcef38ee9c6",
    "iat": 1515160784,
    "exp": 1515167984,
    "aud": "oidcCLIENT",
    "iss": "https://some-address.com"
}

Default configuration

{
    noLogEndpoints : [ '^/api/list/apis$', '^/api/health/check$' ],
    cache : new Cache({ defaultExpire : 3600 }),
    serviceClient : new ServiceClient()
}

Migration notes

v3 to v4

• Due to changes in jsonwebtoken library
  • Removed support for Node versions 11 and below.
  • The verify() function no longer accepts unsigned tokens by default.
  • RSA key size must be 2048 bits or greater.
  • Asymmetric keys cannot be used to sign & verify HMAC tokens.
  • Key types must be valid for the signing / verification algorithm
  • see https://github.com/auth0/node-jsonwebtoken/wiki/Migration-Notes:-v8-to-v9