Rauthy - OpenID Connect Single Sign-On Identity & Access Management

Rauthy is a lightweight and easy to use OpenID Connect Identity Provider. It aims to be simple to both set up and operate, with very secure defaults and lots of config options, if you need the flexibility. It puts heavy emphasis on Passkeys and a very strong security in general. The project is written in Rust to be as memory efficient, secure and fast as possible, and it can run on basically any hardware. If you need Single Sign-On support for IoT or headless CLI tools, it's got you covered as well.
You get High-Availability, client branding, UI translation, a nice Admin UI, Events and Auditing, and many more features. By default, it runs on top of Hiqlite and does not depend on an external database (Postgres as an alternative) to make it even simpler to operate, while scaling up to millions of users easily.

It tries to be as secure as possible by default while still providing all the options needed to be compatible with older systems. For instance, if you create a new OIDC client, it activates ed25519 as the default algorithm for token signing and S256 PKCE flow. This will not work with clients, which do not support it, but you can of course deactivate this to your liking.

Option 1:
Password + Security Key (without User Verification):
Rauthy provides FIDO 2 / Webauthn login flows. If you once logged in on a new client with your username + password, you will get an encrypted cookie which will allow you to log in without a password from that moment on. You only need to have a FIDO compliant Passkey being registered for your account.

Option 2:
Passkey-Only Accounts:
Rauthy supports Passkey-Only-Accounts: you basically just provide your E-Mail address and log in with your FIDO 2 Passkey. Your account will not even have / need a password. This login flow is restricted though to only those passkeys, that can provide User Verification (UV) to always have at least 2FA security.

Discoverable credentials are discouraged with Rauthy (for good reason). This means you will need to enter your E-Mail for the login (which will be autofilled after the first one), but Rauthy passkeys do not use any storage on your device. For instance when you have a Yubikey which can store 25 passkeys, it will not use a single slot there even having full support.

The main goal was to provide an SSO solution like Keycloak and others while using a way lower footprint and being more efficient with resources. For instance, Rauthy can easily run a fully blown SSO provider on just a Raspberry Pi. It makes extensive use of caching for everything used in the authentication chain to be as fast as possible. Most things are even cached for several hours and special care has been taken into account in case of cache eviction and invalidation.

Rauthy comes with two database options:

• with embedded Hiqlite, which is the default setting
• or you can optionally use a Postgres as your database, if you already have an instance running anyway.

The resource usage depends a lot on your setup (Hiqlite, Postgres, HA deployment, amount of users, ...), but for a small set of users, it is usually below 100mb of memory even with the very aggressive, in-memory caching Rauthy uses, and in some cases even below 50mb.

Even though it makes extensive use of caching, you can run it in HA mode. Hiqlite creates its own embedded HA cache and persistence layer. Such a deployment is possible with both Hiqlite and Postgres.

Rauthy does have an Admin UI which can be used to basically do almost any operation you might need to administrate the whole application and its users. There is also an account dashboard for each individual user, where users will get a basic overview over their account and can self-manage som values, password, passkeys, and so on.

You have a simple way to create a branding or stylized look for the Login page for each client. The whole color theme can be changed and each client can have its own custom logo. Additionally, if you modify the branding for the default rauthy client, it will not only change the look for the Login page, but also for the Account and Admin page.

Rauthy comes with an Event- and Alerting-System. Events are generated in all kinds of scenarios. They can be sent via E-Mail, Matrix or Slack, depending on the severity and the configured level. You will see them in the Admin UI in real-time, or you can subscribe to the events stream and externally handle them depending on your own business logic.

Rauthy has brute-force and basic DoS protection for the login endpoint. The timeout will be artificially delayed after enough invalid logins. It auto-blacklists IPs that exceeded too many invalid logins, with automatic expiry of the blacklisting. You can, if you like, manually blacklist certain IPs as well via the Admin UI.

With the possibility to run on devices with very limited resources and having compatibility for the OAuth Device Authorization Grant device_code flow, Rauthy would be a very good choice for IoT projects. The IdP itself can easily run on a Raspberry Pi and all headless devices can be authenticated via the device_code flow. The rauthy-client has everything built-in and ready, if you want to use Rust on the IoT devices as well. It has not been checked in a no_std environment yet, but the client implementation is pretty simple.

Rauthy has no issue handling even millions of users. Everything keeps being fast and responsive, apart from the search function for users in der Admin UI when you reach the 10+ million users, where searching usually takes ~3 seconds (depending on your server of course).
The only limiting factor at that point will be your configuration and needs for password hashing security. It really depends on how many resources you want to use for hashing (more resources == more secure) and how many concurrent logins at the exact same time you need to support.

• Fully working OIDC provider
• Hiqlite or Postgres as database
• Fast and efficient with low footprint
• Secure default values
• Highly configurable
• High-Availability
• True passwordless accounts with E-Mail + Magic Link + Passkey
• Dedicated Admin UI
• Account dashboard UI for each user with self-service
• OpenID Connect Dynamic Client Registration
• OpenID Connect RP Initiated Logout
• OpenID Connect Backchannel Logout
• OAuth 2.0 Device Authorization Grant flow
• Upstream Authentication Providers (Login with ...)
• DPoP tokens for decentralized login flows
• Ephemeral, dynamic clients for decentralized login flows
• SCIM v2 for downstream clients
• All End-User facing sites support i18n server-side translation with the possibility to add more languages
• Simple per client branding for the login page
• Custom roles
• Custom groups
• Custom scopes
• Custom user attributes
• User attribute binding to custom scopes
• Configurable password policy
• Admin API Keys with fine-grained access rights
• Events and alerting system
• Optional event persistence
• Dedicated forward_auth endpoint, in addition to the existing userinfo, with support for configurable trusted auth headers
• Optional event notifications via: E-Mail, Matrix, Slack
• Optional Force MFA for the Admin UI
• Optional Force MFA for each individual client
• Additional encryption inside the database for the most critical entries
• Automatic database backups with configurable retention and auto-cleanup (SQLite only)
• auto-encrypted backups (Hiqlite only)
• Ability to push Hiqlite backups to S3 storage
• auto-restore Hiqlite backups from file or s3
• Username enumeration prevention
• Login / Password hashing rate limiting
• Session client peer IP binding
• IP blacklisting feature
• Auto-IP blacklisting for login endpoints
• Argon2ID with config helper UI utility
• Housekeeping schedulers and cron jobs
• JSON Web Key Set (JWKS) autorotation feature
• Account conversions between traditional password and Passkey only
• Optional open user registration
• Optional user registration domain restriction
• App version update checker
• SwaggerUI documentation
• Configurable E-Mail templates for NewPassword + ResetPassword events
• Prometheus /metrics endpoint on separate port
• No-Setup migrations between different databases (Yes, even between Hiqlite and Postgres)
• Can serve a basic webid document
• Experimental FedCM support

Either just take a look at the Rauthy Book, or start directly by taking a look at the application yourself with docker on your localhost. Rauthy comes with a setting for very quick and easy local testing and taking a first look. By setting LOCAL_TEST=true, an (insecure) demo config is being loaded at startup.

docker run -it --rm -e LOCAL_TEST=true -p 8080:8080 ghcr.io/sebadob/rauthy:0.29.4

This config will only work on localhost though. If you want to use a remote machine for testing, you need to use TLS with at least self-signed certificates. The container image includes some, but you should really only use them for testing.

To use and activate the testing TLS certificates, execute the following:

docker run -it --rm \
  -e LOCAL_TEST=true \
  -e LISTEN_SCHEME=https \
  -e PUB_URL=example.com:8443 \
  -p 8443:8443 \
  ghcr.io/sebadob/rauthy:0.29.4

If you need professional (paid) support for Rauthy, please feel free to contact me at mail@sebadob.dev. Otherwise, please use the Discussions Q&A section. Opened issues, which are actually just support requests, will most probably not be answered at all. I am working on this project mostly in my free time.

If you want to contribute to this repository, please take a look at CONTRIBUTING.md

This project is funded through NGI Zero Core, a fund established by NLnet with financial support from the European Commission's Next Generation Internet program. Learn more at the NLnet project page.