KeyCloak

Feature/OIDC support

✅  PKCE
✅  Nonce
✅  State
✅  Access Token validation
✅  ID Token validation

Introduction

KeyCloak is an open-source identity and access management solution that provides features like single sign-on (SSO), social login, and user management, making it a popular choice for securing applications. This provider has tested defaults for KeyCloak to offer seamless OpenID Connect (OIDC) authentication with minimal necessary configuration.

Example Configurations

Confidential client

keycloak: {
  audience: 'account',
  baseUrl: '',
  clientId: '',
  clientSecret: '', // Set through NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
},

Keycloak uses authenticationScheme: 'header' by default. Header and body authentication require a non-empty client secret after runtime configuration is resolved.

Public client

Public clients use PKCE without client authentication. Set authenticationScheme: 'none' and omit clientSecret:

keycloak: {
  audience: 'account',
  authenticationScheme: 'none',
  baseUrl: '',
  clientId: '',
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
},

ID token validation

The Keycloak preset validates the ID token by default (validateIdToken: true). With the default tokenValidationMode: 'strict', a login is rejected before a session is created unless the ID token has a valid signature from the realm's JWKS, the realm issuer, the client ID as audience, an unexpired exp and the nonce of the authorization request. An ID token in a refresh response must be valid and have the same subject, issuer, audience, authorized party and authentication time as the original one. Keycloak returns one because the preset's nonce: true always adds the openid scope to the authorization request.

In tokenValidationMode: 'legacy', the ID token from the token endpoint is only verified during login when a decoded token audience matches clientId or audience. Legacy mode doesn't check that ID token's nonce or validate refresh responses.

If your Keycloak setup can't issue an ID token that passes validation for the client, you can opt out explicitly:

keycloak: {
  audience: 'account',
  baseUrl: '',
  clientId: '',
  clientSecret: '',
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
  validateIdToken: false,
},

Opting out also stops the nonce check on the ID token from the token endpoint, so keep validation enabled where you can. An id_token posted directly to the callback, as in hybrid flows, is still compared against the nonce in every mode, but only after decoding, without signature verification.

Use logout url

The to redirect to a specific url after logout, use the logoutRedirectUri configuration. You have to specifically allow a redirect uri, if you want your application to redirect to there after logout:

KeyCloak logout redirect

KeyCloak logout redirectClose

keycloak: {
  audience: 'account',
  baseUrl: '',
  clientId: '',
  clientSecret: '',
  redirectUri: 'http://localhost:3000/auth/keycloak/callback',
  userNameClaim: 'preferred_username',
  logoutRedirectUri: 'http://localhost:3000',  // Target of your post logout redirection
},

By default, the following settings are already set internally, but can be overwritten, if needed:

• logoutUrl: protocol/openid-connect/logout,
• logoutRedirectParameterName: post_logout_redirect_uri,

Environment variables

Dotenv files are only for (local) development. Use a proper configuration management or injection system in production.

NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET=CLIENT_SECRET
NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_ID=CLIENT_ID
NUXT_OIDC_PROVIDERS_KEYCLOAK_BASE_URL=http://localhost:8080/realms/nuxt-oidc-test # For local keycloak instance

Provider specific parameters

Additional parameters to be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters:

For more information on these parameters, check the KeyCloak documentation.

Keycloak requires clientId and redirectUri. Confidential clients also require clientSecret. The usual configuration supplies baseUrl, including the realm (for example https://<keycloak-url>/realms/<realm>), so the preset can resolve its relative authorization, token, userinfo, logout, and discovery endpoints.

beta.12+ baseUrl can be omitted when every endpoint used by a flow is configured as an absolute URL. Explicit endpoints take precedence over baseUrl; relative explicit endpoints are resolved against it and fail validation when it is absent. For a complete base-less configuration, provide absolute authorizationUrl, tokenUrl, userInfoUrl, logoutUrl, and openIdConfiguration values, or explicitly disable optional userInfoUrl and logoutUrl behavior with empty strings.

If you don't want to use the post logout redirect feature of Keycloak, set logoutUrl to ''. Enable Client authentication in Keycloak for confidential clients. Leave it disabled for public clients.