Securing Vue Apps with Keycloak
Tags: keycloak, sso, vue, javascript
Published: 2024-04-03 02:26:39

---
canonical_url: https://phasetwo.io/blog/instant-user-managemenet-and-sso-for-vue
---

[Vue.js](https://vuejs.org/) is an open source web framework that makes developing web applications easier.

In this article we'll be using [Keycloak](https://www.keycloak.org/) to secure a Vue.js Web application. We're going to leverage [`oidc-client-ts`](https://www.npmjs.com/package/oidc-client-ts) to integrate OIDC authentication with the Vue app. The [`oidc-client-ts`](https://www.npmjs.com/package/oidc-client-ts) package is a well-maintained and used library. It provides a lot of utilities for building out a fully production app.

{% cta https://phasetwo.io/ %} Phase Two {% endcta %} is a [Keycloak as a Service](https://phasetwo.io/) provider enabling SaaS builders to accelerate time-to-market with powerful enterprise features like SSO, identity, and user management features. Phase Two enhances Keycloak through a variety of open-source extentions for modern SaaS use cases. Phase Two supports both hosted and on-premise deployment options. 

_What is Keycloak?_

[Keycloak](https://www.keycloak.org/) has been a leader in the Identity and Access Management world since its launch almost 8 years ago. It is an open-source offering under the stewardship of [Red Hat](https://www.redhat.com/)

> **INFO**
If you just want to skip to the code, visit the Phase Two [Vue.js example](https://github.com/p2-inc/examples/tree/main/frameworks/vue). We are also building [Keycloak examples](https://github.com/p2-inc/examples) for other frameworks.


## TOC

* [Keycloak Setup](#keycloak-setup)
* [Vue.js + OIDC Client](#vuejs)

---

## Setting up a Keycloak Instance <a name="keycloak-setup"></a>

> **TIP**
If you already have a functioning Keycloak instance, you can skip to the next section.

{% details **Keycloak Setup Details** %} 
Rather than trying to set up a "from scratch" instance of Keycloak, we're going to short-circuit that process by leveraging a Phase Two [free Keycloak](https://phasetwo.io/) starter instance. The Starter provides a free hosted instance of Phase Two's enhanced Keycloak ready for light production use cases.

- Visit the sign-up [page](https://phasetwo.io/dashboard/).
- Enter an email, use a Github account, or use an existing Google account to register.

![Register](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s1jovhdjmmnys3kjp1wb.png)

- Follow the register steps. This will include a sign-in link being sent to your email. Use that for password-less login.

![Email Link](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s73nhw4jl43li164nm5i.png)

- After creating an account, a [realm](https://www.youtube.com/watch?v=ZTFlc-3pG1M) is automatically created for you with all of the Phase Two enhancements. You need to create a Deployment in the Shared Phase Two infrastructure in order to gain access to the realm. Without a deployment created, the Create Shared Deployment modal will automatically pop up.
- Create a Shared Deployment by providing a region (pick something close to your existing infrastructure), a name for the deployment, and selecting the default organization that was created for you upon account creation. Hit "Confirm" when ready. Standby while our robots get to work generating your deployment. This can take a few seconds.

  ![Create shared deployment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7oknshhzra67byi0uxoz.png)

- After the deployment is created and active, you can access the Keycloak Admin console by clicking "Open Console" for that deployment. Open it now to see the console.

![Deployments](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/arwn5n54hbzwocobkmzs.png)

At this point, move on to the next step in the tutorial. We'll be coming back to the Admin Console when its time to start connecting our App to the Keycloak instance.
{% enddetails %}


## Setting up an OIDC Client

We need to create a [OpenID Connect](https://www.keycloak.org/docs/latest/server_admin/#con-oidc_server_administration_guide) Client in Keycloak for the app to communicate with. 

{% details **Details** %}

Keycloak's [docs](https://www.keycloak.org/docs/latest/server_admin/#_oidc_clients) provide steps for how to create an OIDC client and all the various configurations that can be introduced. Follow the steps below to create a client and get the right information necessary for app configuration.

1.  Open the Admin UI by clicking **Open Console** in the Phase Two Dashboard.
1.  Click **Clients** in the menu.
1.  Click **Create client**.
1.  Leave **Client type** set to **OpenID Connect**.
1.  Enter a **Client ID**. This ID is an alphanumeric string that is used in OIDC requests and in the Keycloak database to identify the client.
1.  Supply a **Name** for the client.
1.  Click **Next**.
![General settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6vmlbu0gbf3wdmmacy23.png)
1.  Under the Capability Config section, leave the defaults as selected. This can be configured further later.
- Client authentication to Off.
- Authorization to Off.
- Standard flow checked. Direct access grants checked. All other items unchecked.
1.  Click **Next**.
![Capbility config](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rv9fpa1jgny2300c6btd.png)
1.  Under Login settings we need to add a redirect URI and Web origin in order. Assuming you are using the example application:
**URI and Origin Details**
The choice of `localhost` is arbitrary. If you are using an example application running locally, this will apply. If you are using an app that you actually have deployed somewhere, then you will need to substitute the appropriate URI for that.

    _Valid redirect URI_ (allows redirect back to application)
    ```
    http://localhost:3000/*
    ```
    _Web origins_ (allows for Token auth call)
    ```
    http://localhost:3000
    ```

1.  Click **Save**
![Login settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lk6j7sjbv2b5ns7jc85a.png)
{% enddetails %}

### OIDC Config

{% details **Details** %}

We will need values to configure our application. To get these values follow the instructions below.

1. Click **Clients** in the menu.
1. Find the Client you just created and click on it. In the top right click the **Action** dropdown and select **Download adapter config**.
1. Select **Keycloak OIDC JSON** in the format option. The details section will populate with the details we will need.
   - Note the `realm`, `auth-server-url`, and `resource` values.
![Adapter config](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hjxmpf25hhyogdno2yht.png)

{% enddetails %}

## Adding a Non-Admin User

> **INFO**
It is bad practice to use your Admin user to sign in to an Application.

Since we do not want to use our Admin user for signing into the app we will build, we need to add another non-admin user.

{% details **Details** %}
1.  Open the Admin UI by clicking **Open Console** in the Phase Two Dashboard.
1.  Click **Users** in the menu.
1.  Click **Add user**.
1.  Fill out the information for Email, First name, and Last name. Click **Create**.
1.  We will now set the password for this user manually. Click **Credentials** (tab) and click **Set Password**. Provide a password for this user. For our use case, as a tutorial, you can leave "Temporary" set to "Off".
1.  Click **Save** and confirm the password by clicking **Save password**
{% enddetails %}

---

## Setting up a Vue.js Project <a name="vuejs"></a>

1. Clone the Phase Two [example repo](https://github.com/p2-inc/examples/).
1. Open the Vue [folder](https://github.com/p2-inc/examples/tree/main/frameworks/vue) within `/frameworks/vue` and open the `/nuxt/oidc-client-ts` folder.
1. Run `npm install` and then `npm run dev`.
1. We'll review where we configure out Keycloak instance. First open `/auth.ts`. In this file you will want to update it with the values for the Keycloak instance we set-up earlier in the tutorial. Update the `clientSecret` with the value. Use and environment variable here if you wish.

   ```json
   export const keycloakConfig = {
     authorityUrl: "https://euc1.auth.ac",
     applicationUrl: "http://localhost:3000",
     realm: "shared-deployment-001",
     clientId: "reg-example-1",
     clientSecret: "CLIENT_SECRET",
   };
   ```

   After the config, you can see how the OIDC instance is started.

   ```javascript
   const settings = {
     authority: `${keycloakConfig.authorityUrl}/auth/realms/${keycloakConfig.realm}`,
     client_id: keycloakConfig.clientId,
     client_secret: keycloakConfig.clientSecret,
     redirect_uri: `${window.location.origin}/auth`,
     silent_redirect_uri: `${window.location.origin}/silent-refresh`,
     post_logout_redirect_uri: `${window.location.origin}`,
     response_type: "code",
     userStore: new WebStorageStateStore(),
     loadUserInfo: true,
   };
   this.userManager = new UserManager(settings);
   ```

1. With the Keycloak instance defined, we attach this to the app instance for Vue. Switch to `/main.ts`

   ```javascript
   import Auth from "@/auth";
   // ...
   app.config.globalProperties.$auth = Auth;
   ```

   We pull in the `Auth` instance then expose it through the `$auth` variable.

1. There are a few main pages in play here that we define to create paths the library can leverage. The `/view/auth` and `/view/silent-refresh` create paths at the same name. These are used to do the redirection during authentication. From within these we use the `Auth` instance to direct the user around within the app. For instance in `/views/AuthView`:

   ```javascript
   export default {
     name: "AuthAuthenticated",
     async mounted() {
       try {
         await this.$auth.signinCallback();
         this.$router.push("/");
       } catch (e) {
         console.error(e);
       }
     },
   };
   ```

   The `router.push` naively sends someone to the home page. This could be updated to go to any number of places, including the page one started the login flow from if you were to store that information to be retrieved.

1. Now that we have all the things setup, we can define the user component `/components/User` to easily pull information about the user's state and display the appropriate UI.

   ```javascript
   export default {
     name: "UserComponent",
     data() {
       return {
         user: null,
         signIn: () => this.$auth.signinRedirect(),
         logout: () => this.$auth.signoutRedirect(),
       };
     },
     async created() {
       const user = await this.$auth.getUser();
       if (user) {
         this.user = user;
       }
     },
   };
   ```

   With this, the user object is now easily available. A simple `v-if="user"` allows the app to determine what UI to show.


## Learning more

Phase Two's enhanced Keycloak provides many ways to quickly control and tweak the log in and user management experience. Our [blog](https://phasetwo.io/blog) has many use cases from [customizing login pages](https://phasetwo.io/blog/customizing-login-pages), setting up [magic links](https://phasetwo.io/blog/set-up-magic-links) (password-less sign in), and [Organization](https://phasetwo.io/product/organizations) workflows.