Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 identity provider centered on passkey (WebAuthn) authentication. In production it acts as an authentication gateway: it serves the OIDC/OAuth endpoints (authorization code with PKCE, device authorization, client credentials, pushed authorization requests, token introspection, userinfo, end-session), performs WebAuthn registration/login ceremonies, issues and rotates signed JWTs, and exposes a SvelteKit admin console for managing users, groups, OIDC clients, API permissions, API keys, application config, and audit logs. It also supports SCIM 2.0 provisioning, LDAP directory sync, one-time access codes, email verification, signup flows, and transactional email notifications with per-user locale. Architecturally it is a modular monolith: a Go backend (backend/cmd/main.go as the entry point) built on Gin, GORM, and a fork of the Fosite OIDC framework, with the SvelteKit frontend embedded and served by the same process. Data flows are typical of an IdP: browser/SP clients hit OIDC endpoints, the backend persists users, tokens, clients, and audit events to SQLite or PostgreSQL (50+ up/down migrations for each), reads/writes user content through a filesystem/S3/database storage abstraction, and delegates ephemeral state and cron jobs (token cleanup, API key expiry, back-channel logout, rate limiting) to the Francis actor runtime. External dependencies include SMTP servers, LDAP directories, SCIM providers, MaxMind GeoLite2 downloads for audit-log geolocation, optional S3-compatible object storage, and optional standalone Francis. The codebase shows strong engineering discipline: dependency-injected services, a layered DTO mapping and validation layer with stable error codes, an authorization scope catalog enforced at the router level, middleware for CSP/CORS/rate limiting/CSRF, a generic TTL cache with singleflight, SSRF-guarded outbound HTTP with per-purpose host allowlists, field-level encrypted strings, and callback-URL wildcard validation. Tests are extensive and include Go unit tests, migration parity checks between SQLite and PostgreSQL, route-scope coverage tests, and Playwright E2E suites. The main maintenance risks are the forked Fosite dependency, the non-trivial operator complexity of the Francis actor runtime, and a high rate of schema migrations; HA mode is explicitly experimental. This is unambiguously an application repository; its only data-adjacent features are IP-geolocation enrichment and an opt-in analytics heartbeat.
Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
Athenz is an open-source, fine-grained authorization and identity management platform designed for zero-trust environments. It provides centralized (ZMS) and decentralized (ZTS) services for issuing short-lived X.509 certificates, managing role-based access control (RBAC), and enforcing policies across multi-cloud and on-premise infrastructures. The system supports AWS, GCP, Azure, and Kubernetes workloads through pluggable attestation validators and credential providers, enabling service-to-service authentication and authorization without shared secrets. Architecturally, Athenz comprises three core servers: ZMS (management service for domains, roles, policies), ZTS (token service for certificates, OAuth2 tokens, SSH certs), and MSD (micro-segmentation for network policy management). A React/Next.js UI provides administrative management, while client libraries in Java, Go, and Node.js enable integration. The codebase is organized into modular Maven submodules with RDL-generated data models, extensive unit/integration tests, and Docker/Kubernetes deployment artifacts. Key patterns include factory-based dependency injection (e.g., cert signers, private key stores, notification services), dynamic configuration reloading, and composite validators for cloud attestation. This is a production-grade application with clean abstractions, well-defined interfaces, and significant test coverage. While the codebase contains some generated boilerplate and cloud-specific implementations that may drift, the core libraries and utility classes are reusable and demonstrate strong engineering practices.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.