Matt
0ae190b255
## **SOLUTION: Migrate to Server-Side OIDC Authentication**
This completely replaces the problematic keycloak-js client-side implementation
with nuxt-oidc-auth, eliminating all CORS and iframe issues.
### **Benefits:**
- **No more CORS errors** - Server-side OAuth flow
- **No iframe dependencies** - Eliminates cross-domain issues
- **Works with nginx proxy** - No proxy configuration conflicts
- **Better security** - Tokens handled server-side
- **Cleaner integration** - Native Nuxt patterns
- **Maintains Directus compatibility** - Dual auth support
### **Installation & Configuration:**
- Added
uxt-oidc-auth module to nuxt.config.ts
- Configured Keycloak provider with proper OIDC settings
- Updated environment variables for security keys
### **Code Changes:**
#### **Authentication Flow:**
- **middleware/authentication.ts** - Updated to check both Directus + OIDC auth
- **composables/useUnifiedAuth.ts** - Migrated to use useOidcAuth()
- **pages/login.vue** - Updated SSO button to use oidcLogin('keycloak')
#### **Configuration:**
- **nuxt.config.ts** - Added OIDC provider configuration
- **.env.example** - Updated with nuxt-oidc-auth environment variables
- Removed old Keycloak runtime config
#### **Cleanup:**
- Removed keycloak-js dependency from package.json
- Deleted obsolete files:
- composables/useKeycloak.ts
- pages/auth/callback.vue
- server/utils/keycloak-oauth.ts
- server/api/debug/ directory
### **Authentication Routes (Auto-Generated):**
- /auth/keycloak/login - SSO login endpoint
- /auth/keycloak/logout - SSO logout endpoint
- /auth/keycloak/callback - OAuth callback (handled automatically)
### **Security Setup Required:**
Environment variables needed for production:
- NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET
- NUXT_OIDC_TOKEN_KEY (base64 encoded 32-byte key)
- NUXT_OIDC_SESSION_SECRET (48-character random string)
- NUXT_OIDC_AUTH_SESSION_SECRET (48-character random string)
### **Expected Results:**
SSO login should work without CORS errors
Compatible with nginx proxy setup
Maintains existing Directus authentication
Server-side session management
Automatic token refresh
Ready for container rebuild and production testing!
29 lines
1.0 KiB
Plaintext
29 lines
1.0 KiB
Plaintext
# MinIO Configuration
|
|
NUXT_MINIO_ACCESS_KEY=your-minio-access-key
|
|
NUXT_MINIO_SECRET_KEY=your-minio-secret-key
|
|
|
|
# NocoDB Configuration (existing)
|
|
NUXT_NOCODB_URL=your-nocodb-url
|
|
NUXT_NOCODB_TOKEN=your-nocodb-token
|
|
|
|
# Email Configuration
|
|
NUXT_EMAIL_ENCRYPTION_KEY=your-32-character-encryption-key
|
|
NUXT_EMAIL_IMAP_HOST=mail.portnimara.com
|
|
NUXT_EMAIL_IMAP_PORT=993
|
|
NUXT_EMAIL_SMTP_HOST=mail.portnimara.com
|
|
NUXT_EMAIL_SMTP_PORT=587
|
|
NUXT_EMAIL_LOGO_URL=https://portnimara.com/Port_Nimara_Logo_2_Colour_New_Transparent.png
|
|
|
|
# Documenso Configuration
|
|
NUXT_DOCUMENSO_API_KEY=your_documenso_api_key_here
|
|
NUXT_DOCUMENSO_BASE_URL=https://signatures.portnimara.dev
|
|
|
|
# Webhook Configuration for Embedded Signing
|
|
WEBHOOK_SECRET_SIGNING=96BQQRiKkTIN2w0rHbqo7yHggV/sT8702HtHih3uNSY=
|
|
|
|
# nuxt-oidc-auth Configuration
|
|
NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET=your-keycloak-client-secret
|
|
NUXT_OIDC_TOKEN_KEY=base64_encoded_32_byte_key
|
|
NUXT_OIDC_SESSION_SECRET=48_character_random_string_for_session_security
|
|
NUXT_OIDC_AUTH_SESSION_SECRET=48_character_random_string_for_auth_session
|