Matt
d436367ee6
FEAT: Enhance authentication session management with configurable cookie domain and improved token refresh logic
2025-06-16 17:53:43 +02:00
Matt
a7df6834d7
FEAT: Migrate authentication system from Directus to Keycloak, implementing token refresh and enhancing session management
2025-06-15 17:37:14 +02:00
Matt
8048cde5b6
FIX: Correct Keycloak callback path to /api
...
## **Fixed 404 Error:**
### **Issue:**
- Keycloak was redirecting to /auth/keycloak/callback
- But our server endpoint was at /api/auth/keycloak/callback
- This caused a 404 Page Not Found error
### **Solution:**
- Updated useCustomAuth.ts redirect URI to include /api prefix
- Updated server callback endpoint to match the new path
- Both client and server now use: /api/auth/keycloak/callback
### **Files Changed:**
- composables/useCustomAuth.ts - Updated login redirect URI
- server/api/auth/keycloak/callback.ts - Updated token exchange redirect URI
## **Result:**
Now when users click 'Login with SSO':
1. Redirect to Keycloak
2. Keycloak redirects back to /api/auth/keycloak/callback
3. Server handles the callback properly
4. User gets authenticated and redirected to dashboard
The 404 error should be resolved and SSO login should work!
2025-06-15 15:43:08 +02:00
Matt
c5aa294487
COMPLETE: Custom Keycloak SSO Authentication System
...
## **Successful Migration from nuxt-oidc-auth to Custom Solution:**
### ** What We Built:**
- **Removed problematic
uxt-oidc-auth** that was causing 502 errors
- **Removed @nuxtjs/auth-next** (incompatible with Nuxt 3)
- **Built custom OAuth 2.0 flow** that actually works!
### ** New Authentication Architecture:**
#### **Server-Side API Endpoints:**
- /api/auth/keycloak/callback - Handles OAuth callback & token exchange
- /api/auth/session - Check authentication status
- /api/auth/logout - Clear session & redirect to Keycloak logout
- /api/health - Health check endpoint for debugging
#### **Client-Side Integration:**
- composables/useCustomAuth.ts - Vue composable for auth state management
- Updated login page to use custom authentication
- Secure cookie-based session management
### ** Authentication Flow:**
1. **User clicks SSO login** Redirect to Keycloak
2. **Keycloak authenticates** Callback to /auth/keycloak/callback
3. **Server exchanges code** Get access token & user info
4. **Session created** Secure cookie set
5. **User redirected** Dashboard with active session
### ** Key Features:**
- **No 502 errors** - Built-in error handling
- **Session persistence** - Secure HTTP-only cookies
- **Automatic expiration** - Token validation & cleanup
- **Dual auth support** - Keycloak SSO + Directus fallback
- **Proper logout** - Clears both app & Keycloak sessions
### ** Security Improvements:**
- **HTTP-only cookies** prevent XSS attacks
- **Secure flag** for HTTPS-only transmission
- **SameSite protection** against CSRF
- **Token validation** on every request
### ** Environment Variables Needed:**
- KEYCLOAK_CLIENT_SECRET - Your Keycloak client secret
- All existing variables remain unchanged
## **Result: Working Keycloak SSO!**
The custom implementation eliminates the issues with
uxt-oidc-auth while providing:
- Reliable OAuth 2.0 flow
- Proper error handling
- Session management
- Clean logout process
- Full Keycloak integration
## **Ready to Deploy:**
Deploy this updated container and test the SSO login - it should work without 502 errors!
2025-06-15 15:36:48 +02:00
Matt