Auth Awesome

• IAM - Identity and Access Management
  • kdeldycke/awesome-iam
  • casdoor/casdoor
    • Apache-2.0, Go, JS
    • UI-first Identity Access Management (IAM) / Single-Sign-On (SSO) platform
    • OIDC, OAuth 2.0, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP
    • based on Casbin
  • dromara/MaxKey
    • Apache-2.0, Java
    • Enterprise IAM/SSO
  • topiam/eiam
    • Apache-2.0, Java, Vue
    • Enterprise IAM
• keepassxreboot/keepassxc
• babelouest/glewlwyd
• longguikeji/arkid
  • AGPLv3, Python
• bullteam/zeus-admin
  • Apache-2.0, Go+Vue
• OpenIdentityPlatform/OpenAM
  • Java
• kanidm/kanidm
  • MPL-2.0, Rust
• authelia/authelia
  • Apache-2.0, Go
  • SSO Multi-Factor portal for web apps
• OpenID Provider (OP), Identity Provider (IDP)
  • 实现了 OpenID Connect 和 OAuth 2.0
• Relying Party (RP)
  • 应用或网站
  • 将用户授权转交给 IdP
• logto-io/logto
  • MPLv2, TS
  • open-source alternative to Auth0
• eicrud/eicrud
  • MIT, TS
  • CRUD/Authorization framework based on NestJS
• Service
  • better-auth/better-auth
    • MIT, TS

Client

Client/Web/Library/SDK/Integration

• Framework
  • nextauthjs/next-auth
    • ISC, TS
    • Authentication for the Web
• auth0/node-jsonwebtoken
  • MIT, JS
  • jsonwebtoken
• panva/jose
  • MIT, TS, JS
  • JWA, JWS, JWE, JWT, JWK, JWKS
• passport
• authts/oidc-client-ts
  • Apache-2.0, TS
• panva/node-openid-client
  • OpenID Certified™ Relying Party

Design

• Google Cloud
  • Policies
  • IAM permissions reference
  • 资源名称
    • //{api}/{collection-id}/{resource-id}(/{collection-id}/{resource-id})*
    • //mail.googleapis.com/users/[email protected]/settings/customFrom
    • 无传输协议

Authentication

AuthN/Authentication/OAuth2 Server/IdP/IAM

• oauth.net/code

• zitadel/zitadel

  • Apache-2.0, Go, TS
  • by CAOS from Switzerland
  • 提供 gRPC 接口
  • CockroachDB/PostgreSQL
  • zitadel vs keycloak

• goauthentik/authentik

  • GPL-3.0, Python, TS

• node-oauth/node-oauth2-server

  • MIT, JS
  • npm:@node-oauth/oauth2-server
  • successor to oauthjs/node-oauth2-server

• boxyhq/jackson

  • Apache-2.0, Typescript
  • supporting SAML and OpenID Connect
  • Directory Sync via the SCIM 2.0 protocol

• panva/node-oidc-provider

  • MIT, NodeJS, JS
  • panva/oauth4webapi
    • MIT, TS
    • OAuth 2 / OpenID Connect

• dexidp/dex

  • Apache-2.0, Go
  • OpenID Connect Identity (OIDC) and OAuth 2.0 Provider with Pluggable Connectors

• ory/hydra

  • Apache-2.0, Go
  • OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go

• keycloak/keycloak

  • Apache-2.0, Java

• kanidm/kanidm

  • MPL-2.0, Rust
  • SSH/PAM/RADIUS/Web OAuth
  • oauth design

• compare open-source-sso

• OpenIAM

• Apache Syncope

• FreeIPA

  • Python

• WSO2

• apereo/cas - Central Authentication Service

• Okta

• FusionAuth

• LDAP/GSSAPI

• Kerberos

  • not use public key crypto

• supertokens/supertokens-core

  • Apache-2.0, Java

• ory/kratos

Authorization

AuthZ/Authorization/Policy/ACL/RBAC/ABAC

• casbin
• ory/oathkeeper
  • Identity & Access Proxy
• osohq/oso
  • Apache-2.0, Rust+Python
  • 引擎开源/Policy - Rust 实现
    • 语言库: Node.js, Python, Go, Rust, Ruby, Java
  • 商业化服务平台
  • 参考
    • www.osohq.com/academy
• stalniy/casl
  • Isomorphic Authorization JavaScript library
  • @casl/ability - 20.5kB/7kB - @ucast/core, @ucast/js, @ucast/mongo
    • @ucast - 条件转换
  • @casl/react - 2kB/1kB

Zanzibar

• authzed/spicedb
  • Apache-2.0, Go
  • AuthZ as a Service
  • gRPC API+REST
  • 支持 pg, mysql, cockroachdb, hashicorp/go-memdb
  • HN
• aserto-dev/topaz
  • Apache-2.0, Go
  • Open Policy Agent
  • BoltDB
• Permify/permify
  • Apache-2.0, Go
  • 通过 CDC 同步信息
  • why-decouple-authorizations
• openfga/openfga
  • Apache-2.0, Go
  • by Auth0 FGA
    • dashboard.fga.dev
  • PostgreSQL 14, MySQL 8, SQLite
• ory/keto
  • Apache-2.0, Go
• josephglanville/zanzibar-pg
• authorizer-tech/access-controller
• 参考
  • RBAC - 角色固定
  • ReBAC - 基于关系
  • ABAC - 基于属性，任意属性
  • HBAC - Host Based Access Control
  • What is Zanzibar?
  • www.osohq.com/learn/google-zanzibar

Proxy

API 网关通常支持 auth、authz

• ForwardAuth
  • oauth2-proxy/oauth2-proxy
    • 也支持作为反向代理
  • vouch/vouch-proxy
• pomerium/pomerium
  • Apache-2.0, Go
  • Pomerium is an identity-aware access proxy.
  • Enterprise
    • 管理界面
    • API
    • Session

Reference

• Google Authentication/Authorization for Enterprise SPI Guide
• How to Design a Permissions Framework