Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
Wait-for-secrets is a GitHub Action designed to pause workflow execution until a user manually inputs required secrets via a web interface. It leverages GitHub's OIDC tokens to authenticate with the StepSecurity API, which temporarily stores secret metadata and provides a unique URL for user interaction. The action polls the API until secrets are submitted, then makes them available as outputs for subsequent workflow steps. Key features include optional Slack notifications and configurable timeouts. The architecture is straightforward: a TypeScript-based action compiled via ncc into a single JavaScript file, with core logic separated into utility functions for environment parsing, URL generation, and secret handling.
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
gimme-aws-creds is a Python CLI tool for obtaining temporary AWS and Alibaba Cloud credentials via Okta SAML authentication. It supports both Okta Classic and Identity Engine flows, handles multiple MFA methods (push, TOTP, hardware tokens, SMS, email, FIDO2/WebAuthn, Duo), and exchanges SAML assertions for temporary cloud credentials. The tool outputs credentials in various formats (export, JSON, Windows PowerShell) or writes them to standard credential files (~/.aws/credentials, ~/.aliyun/config.json). The application features a modular architecture with separate modules for Okta authentication (okta_classic.py, okta_identity_engine.py), cloud provider resolution (aws.py, alibaba_cloud.py), configuration management (config.py), MFA handling (duo.py, u2f.py, webauthn.py), and shared utilities (common.py, ui.py, debug_formatter.py). Key entry points include bin/gimme-aws-creds (main executable) and platform-specific wrappers. Data flows involve parsing configuration/authentication options, performing Okta authentication with MFA, extracting SAML assertions, assuming cloud roles via STS APIs, and formatting output. Notable reusable components include a flexible configuration system with inheritance and source tracking (config.py), isolated SAML parsing utilities (common.py), a UI abstraction layer for testability (ui.py), and a secure HTTP logging formatter that automatically redacts sensitive data (debug_formatter.py). The project is actively maintained but shows medium technical drift due to platform-specific WebAuthn dependencies requiring older Python versions on Windows and the complexity of maintaining compatibility with multiple authentication systems and cloud providers.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
This is a fully-featured OAuth2 and OpenID Connect authentication and authorization server built with Node.js/TypeScript and the Curveball framework. It provides user management, role-based access control, multi-factor authentication (TOTP, WebAuthn), and an administrative web UI. The project is self-contained with its own database migrations, CLI binary, and Docker support. It supports multiple database backends (PostgreSQL, MySQL, SQLite) via Knex. The codebase is well-structured following a modular architecture with clear separation between controllers, services, and format handlers. It implements the OAuth2 authorization framework including authorization code, client credentials, implicit, and refresh token grants with PKCE support. The OpenID Connect layer provides discovery, JWKS, and userinfo endpoints. Authentication is modular with pluggable challenge strategies for passwords, TOTP, email OTP, and WebAuthn. The project is retired, as explicitly stated in the README, and the authors recommend migrating to Keycloak. Despite being deprecated, the code remains a solid reference implementation for OAuth2/OIDC in Node.js and contains several reusable components including an abstract key-value store, an SMS adapter pattern, and cryptographic utilities.