The auth0-spa-js repository is a JavaScript/TypeScript SDK for authenticating Single Page Applications (SPAs) with Auth0. It implements the Authorization Code Flow with PKCE, providing methods for user login (redirect and popup), silent token acquisition, token refresh, logout, and user information retrieval. The SDK includes advanced features such as Multi-Factor Authentication (MFA), passkey/WebAuthn support, DPoP (Demonstrating Proof of Possession) for token security, Multi-Resource Refresh Tokens (MRRT), and custom token exchange per RFC 8693. Architecture-wise, it is modular with separate concerns: core authentication (Auth0Client), caching (memory and localStorage), storage (cookies and session storage), Web Worker for token operations, and specialized modules for MFA, passkeys, and account management. Key entry points include the `createAuth0Client` factory function and the `Auth0Client` class. The library relies on @auth0/auth0-auth-js for low-level Auth0 interactions and browser-tabs-lock for cross-tab synchronization.
Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
This repository is a Java library for JSON Web Token (JWT) handling per RFC 7519. It provides comprehensive functionality for creating, signing, verifying, and decoding JWTs, supporting multiple cryptographic algorithms including HMAC (HS256/384/512), RSA (RS256/384/512, PS256/384/512), EC (ES256/384/512), and EdDSA (Ed25519/Ed448). The library also includes utilities for JSON Web Key (JWK) management, PEM encoding/decoding of keys and certificates, and ASN.1 DER parsing for low-level cryptographic operations. Architecturally, the library follows a modular structure with clear separation of concerns: core JWT operations in the `jwt` package, JWK handling in `jwks`, PEM utilities in `pem`, and DER parsing in `der`. Cryptographic operations are abstracted through `Signer` and `Verifier` interfaces, enabling the Strategy pattern for pluggable algorithm implementations. Object creation uses the Builder pattern for immutable, fluent APIs (e.g., `JWT.addClaim()`, `KeyPair.build()`). JSON processing is centralized via a configured Jackson `Mapper` with custom serializers/deserializers for Java 8+ date-time types. The design minimizes coupling, allowing components like `JWTUtils` or `HMACSigner` to be reused independently. The library is actively maintained, with recent commits (2026-07-15) and ongoing security updates (e.g., patches for CVE-2022-21449). Dependencies are managed via Maven/Savant, relying primarily on Jackson for JSON processing with optional Bouncy Castle for certain algorithms. The codebase demonstrates strong engineering practices: comprehensive unit tests cover all algorithms and edge cases, clear exception hierarchies provide specific error handling, and Java 9+ module system support is included. It serves as a robust, reusable foundation for any Java application requiring secure token-based authentication or authorization.
This is a TypeScript library implementing an OpenID Connect (OIDC) and OAuth2 client for browser-based applications. It supports Authorization Code Grant with PKCE, refresh tokens, resource owner password credentials, and DPoP, while explicitly excluding the deprecated implicit grant. The library provides both a low-level `OidcClient` for raw protocol operations and a higher-level `UserManager` with session management, event notifications, and automatic silent token renewal via iframes or pop-ups. It is a fork of the archived `oidc-client-js` project, ported to TypeScript with strict typing, comprehensive testing (vitest, jsdom), and modern build tooling (esbuild, ESLint, Husky). The architecture is cleanly layered: a settings store with defaults, navigator abstraction for browser UI (redirect, popup, iframe), storage abstraction for state persistence (in-memory, localStorage, IndexedDB), and an event system for lifecycle callbacks. The codebase demonstrates high craftsmanship with well-isolated, reusable components such as the generic Event emitter, a sleep-aware Timer, and a strategy-pattern for navigation. DPoP support is implemented with secure key storage in IndexedDB and automatic nonce retry. External runtime dependencies are minimal (only `jwt-decode`). Active maintenance is evidenced by regular commits, dependabot configuration, CI workflows, and a versioned release process. This library is suitable for any browser-based SPA requiring standards-compliant OIDC/OAuth2 authentication.
angular-oauth2-oidc is an Angular client library for OAuth 2.0 and OpenID Connect authentication in browser SPAs. Its core is OAuthService, a large stateful injectable that loads OIDC discovery documents, drives login via implicit flow, code flow + PKCE, or password flow, stores tokens through a pluggable OAuthStorage (default sessionStorage, with MemoryStorage fallback), validates tokens through pluggable ValidationHandler implementations, runs silent refresh/session checks via hidden iframes, and emits a typed event stream (OAuthEvent hierarchy) for lifecycle notifications. DefaultOAuthInterceptor attaches bearer tokens to outgoing HTTP calls against configured allowed URLs; UrlHelperService extracts tokens from redirect URLs for both hash and query strategies.
This is the official Auth0 React SDK (`@auth0/auth0-react`), a client-side library that provides React bindings for Auth0 authentication. It wraps the core `@auth0/auth0-spa-js` library and exposes a React-friendly API via context, hooks, and higher-order components. The architecture follows a standard React context provider pattern: `Auth0Provider` wraps the application tree, and `useAuth0` (or `useAuth0Suspense`) provides authentication state and methods (login, logout, token management, MFA, passkeys). The SDK supports OAuth2 Authorization Code Grant with PKCE, refresh token rotation, DPoP, and custom token exchange. It is designed for single-page applications and is compatible with React 19+, including Next.js App Router (via `'use client'` directive injection). Key entry points include `Auth0Provider` (the root provider), `useAuth0` (primary hook), `useAuth0Suspense` (Suspense-enabled variant), `withAuthenticationRequired` (HOC for route protection), and `withAuth0` (legacy HOC). The SDK manages authentication state through a reducer (`src/reducer.tsx`) and provides a rich error hierarchy (`OAuthError`, `MfaRequiredError`, etc.). External dependencies are minimal: React, ReactDOM, and `@auth0/auth0-spa-js`. The codebase is well-tested with Jest unit tests (using a manual mock for the underlying SDK) and Cypress integration tests against a live Auth0 tenant. The SDK demonstrates strong engineering practices: typed interfaces, memoized context values, structured error handling, and a clear separation of concerns between the provider, hooks, and HOCs. It includes generated TypeDoc documentation and example applications for Vite, Gatsby, and Next.js. While the library is tightly coupled to the Auth0 ecosystem, its patterns (context-based auth, Suspense integration, error hierarchy) are reusable in other authentication contexts.
This repository is a Home Assistant custom component that implements a full OpenID Connect (OIDC) Client/Relying Party for authentication. It allows Home Assistant users to log in via an external OIDC Identity Provider (IdP) such as Authentik, Authelia, Keycloak, or any standard OIDC-compliant server. The integration registers a custom auth provider within Home Assistant's auth system, intercepts the default login flow to redirect users to the OIDC provider, and handles the full authorization code flow including PKCE (RFC 7636), ID token validation with configurable signing algorithms, and userinfo retrieval. It supports both public and confidential clients, device code flow for mobile app login, automatic user linking, role-based access mapping from IdP groups, and a multi-step UI configuration wizard for easy setup.
django-auth-adfs is a Django authentication backend that enables integration with Microsoft ADFS and Azure AD for single sign-on (SSO). It implements OAuth2 and OpenID Connect flows to authenticate users against enterprise identity providers, automatically creating and updating Django users based on identity claims. The package provides Django authentication backends, middleware for enforcing authentication, URL handlers for the OAuth2 flow, and Django REST Framework integration for token-based API authentication. The architecture follows Django best practices with clear separation of concerns between configuration, backend logic, views, and middleware.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
MaxKey is an enterprise-grade Identity and Access Management (IAM) / Single Sign-On (SSO) platform written in Java (Spring Boot) with Angular frontends. It supports a comprehensive set of authentication protocols (OAuth 2.0/OpenID Connect, SAML 2.0, CAS, JWT, form-based, token-based) and identity federation standards (SCIM 2.0, LDAP, Active Directory). The codebase is organized as a multi-module Maven project with clear separation between authentication providers, protocol implementations, persistence layer, and web UIs. Architecturally, it follows a service-oriented model with a custom OAuth2 stack (derived from Spring Security OAuth), MyBatis JPA for persistence, and Redis/Caffeine for caching. The frontends are built on NG-ALAIN (Angular 17) and share a common base for user portal and admin console. While the system is functionally rich and actively maintained, it contains some duplicated code across modules and relies on a legacy OAuth2 implementation that has been superseded by Spring Security 5+. The crypto utilities, OTP infrastructure, and adapter patterns are well-structured and demonstrate non-obvious craftsmanship.
This is a fully-featured OAuth2 and OpenID Connect authentication and authorization server built with Node.js/TypeScript and the Curveball framework. It provides user management, role-based access control, multi-factor authentication (TOTP, WebAuthn), and an administrative web UI. The project is self-contained with its own database migrations, CLI binary, and Docker support. It supports multiple database backends (PostgreSQL, MySQL, SQLite) via Knex. The codebase is well-structured following a modular architecture with clear separation between controllers, services, and format handlers. It implements the OAuth2 authorization framework including authorization code, client credentials, implicit, and refresh token grants with PKCE support. The OpenID Connect layer provides discovery, JWKS, and userinfo endpoints. Authentication is modular with pluggable challenge strategies for passwords, TOTP, email OTP, and WebAuthn. The project is retired, as explicitly stated in the README, and the authors recommend migrating to Keycloak. Despite being deprecated, the code remains a solid reference implementation for OAuth2/OIDC in Node.js and contains several reusable components including an abstract key-value store, an SMS adapter pattern, and cryptographic utilities.
The Kong OIDC plugin is an OpenID Connect Relying Party (RP) implementation for the Kong API gateway. It authenticates users against an OpenID Connect Provider using the Authorization Code flow and supports token introspection for Bearer tokens. The plugin maintains user sessions and adds headers (X-Userinfo, X-Access-Token, X-ID-Token) to the upstream request for use by backend services. The plugin follows a modular architecture with separate modules for handling the main logic (handler.lua), request filtering (filter.lua), session configuration (session.lua), and utility functions (utils.lua). It relies on the `lua-resty-openidc` library for the core OIDC protocol handling. Key features include configurable session storage (client-side cookie or server-side via shared memory, memcache, or Redis), caching of discovery documents and access tokens, and support for both authentication and token introspection modes. Note: This repository is not maintained and is not recommended for use in production, as indicated in the README. The last commit history shows no recent activity, and dependencies are outdated relative to current Kong and OIDC library versions.
This is the Katana project: Microsoft's implementation of the OWIN (Open Web Interface for .NET) specification for .NET Framework. It provides a middleware pipeline, hosting infrastructure (self-host via HttpListener and IIS integration via System.Web), and a rich set of middleware including static files, diagnostics, CORS, and an extensive authentication/authorization suite covering cookies, OAuth 2.0, OpenID Connect, WS-Federation, JWT, and social providers (Google, Facebook, Twitter, Microsoft Account). The architecture is built around the OWIN environment dictionary flowing through composable middleware. Key entry points include `WebApp.Start()` for programmatic hosting, `OwinHttpHandler`/`OwinHttpModule` for IIS integration, and the `OwinHost.exe` command-line tool. The codebase is well-architected with patterns like `AuthenticationHandler<T>` base class, `IAppBuilder` extensions, and service abstraction interfaces, but it is deprecated in favor of ASP.NET Core. It targets .NET Framework 4.5 exclusively and uses legacy package management (`packages.config`). While the core patterns remain instructive, the library is not directly reusable for modern .NET development without significant porting.