Provider

KeyCloak

KeyCloak provider documentation

Feature/OIDC support

✅ PKCE
✅ Nonce
❌ State
✅ Access Token validation
❌ ID Token validation

KeyCloak is an open-source identity and access management solution that provides features like single sign-on (SSO), social login, and user management, making it a popular choice for securing applications. This provider has tested defaults for KeyCloak to offer seamless OpenID Connect (OIDC) authentication with minimal necessary configuration.

Example Configurations

Never store sensitive values like client secrets in your Nuxt config. Inject confidential-client secrets through environment variables.

Confidential client

nuxt.config.ts

keycloak: {
  audience: 'account',
  baseUrl: '',
  clientId: '',
  clientSecret: '', // Set through NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
},

Keycloak uses authenticationScheme: 'header' by default. Header and body authentication require a non-empty client secret after runtime configuration is resolved.

Public client

Public clients use PKCE without client authentication. Set authenticationScheme: 'none' and omit clientSecret:

nuxt.config.ts

keycloak: {
  audience: 'account',
  authenticationScheme: 'none',
  baseUrl: '',
  clientId: '',
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
},

Use logout url

The to redirect to a specific url after logout, use the logoutRedirectUri configuration. You have to specifically allow a redirect uri, if you want your application to redirect to there after logout:

KeyCloak logout redirect

nuxt.config.ts

keycloak: {
  audience: 'account',
  baseUrl: '',
  clientId: '',
  clientSecret: '',
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
  userNameClaim: 'preferred_username',
  logoutRedirectUri: 'http://localhost:3000',  // Target of your post logout redirection
},

By default, the following settings are already set internally, but can be overwritten, if needed:

logoutUrl: protocol/openid-connect/logout,
logoutRedirectParameterName: post_logout_redirect_uri,

If you want to use the post logout redirect feature, you should not set exposeIdToken to false, because the ID token is required to hand over to the post logout redirect url.

Environment variables

Dotenv files are only for (local) development. Use a proper configuration management or injection system in production.

.env

NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET=CLIENT_SECRET
NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_ID=CLIENT_ID
NUXT_OIDC_PROVIDERS_KEYCLOAK_BASE_URL=http://localhost:8080/realms/nuxt-oidc-test # For local keycloak instance

Provider specific parameters

Additional parameters to be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters:

Option	Type	Default	Description
prompt	`string`	-	Optional. This parameter allows to slightly customize the login flow on the KeyCloak server side. For example, enforce displaying the login screen in case of value login.
loginHint	`string`	-	Optional. Used to pre-fill the username/email field on the login form.
idpHint	`string`	-	Optional. Used to tell KeyCloak to skip showing the login page and automatically redirect to the specified identity provider instead.
locale	`string`	-	Optional. Sets the 'ui_locales' query param.

For more information on these parameters, check the KeyCloak documentation.

Keycloak requires clientId and redirectUri. Confidential clients also require clientSecret. The usual configuration supplies baseUrl, including the realm (for example https://<keycloak-url>/realms/<realm>), so the preset can resolve its relative authorization, token, userinfo, logout, and discovery endpoints.

baseUrl can be omitted when every endpoint used by a flow is configured as an absolute URL. Explicit endpoints take precedence over baseUrl; relative explicit endpoints are resolved against it and fail validation when it is absent. For a complete base-less configuration, provide absolute authorizationUrl, tokenUrl, userInfoUrl, logoutUrl, and openIdConfiguration values, or explicitly disable optional userInfoUrl and logoutUrl behavior with empty strings.

If you don't want to use the post logout redirect feature of Keycloak, set logoutUrl to ''. Enable Client authentication in Keycloak for confidential clients. Leave it disabled for public clients.

GitHub

GitHub provider documentation

Logto

Logto provider documentation