Pocket ID is a self-hosted OpenID Connect and OAuth 2.0 identity provider centered on passkey (WebAuthn) authentication. In production it acts as an authentication gateway: it serves the OIDC/OAuth endpoints (authorization code with PKCE, device authorization, client credentials, pushed authorization requests, token introspection, userinfo, end-session), performs WebAuthn registration/login ceremonies, issues and rotates signed JWTs, and exposes a SvelteKit admin console for managing users, groups, OIDC clients, API permissions, API keys, application config, and audit logs. It also supports SCIM 2.0 provisioning, LDAP directory sync, one-time access codes, email verification, signup flows, and transactional email notifications with per-user locale. Architecturally it is a modular monolith: a Go backend (backend/cmd/main.go as the entry point) built on Gin, GORM, and a fork of the Fosite OIDC framework, with the SvelteKit frontend embedded and served by the same process. Data flows are typical of an IdP: browser/SP clients hit OIDC endpoints, the backend persists users, tokens, clients, and audit events to SQLite or PostgreSQL (50+ up/down migrations for each), reads/writes user content through a filesystem/S3/database storage abstraction, and delegates ephemeral state and cron jobs (token cleanup, API key expiry, back-channel logout, rate limiting) to the Francis actor runtime. External dependencies include SMTP servers, LDAP directories, SCIM providers, MaxMind GeoLite2 downloads for audit-log geolocation, optional S3-compatible object storage, and optional standalone Francis. The codebase shows strong engineering discipline: dependency-injected services, a layered DTO mapping and validation layer with stable error codes, an authorization scope catalog enforced at the router level, middleware for CSP/CORS/rate limiting/CSRF, a generic TTL cache with singleflight, SSRF-guarded outbound HTTP with per-purpose host allowlists, field-level encrypted strings, and callback-URL wildcard validation. Tests are extensive and include Go unit tests, migration parity checks between SQLite and PostgreSQL, route-scope coverage tests, and Playwright E2E suites. The main maintenance risks are the forked Fosite dependency, the non-trivial operator complexity of the Francis actor runtime, and a high rate of schema migrations; HA mode is explicitly experimental. This is unambiguously an application repository; its only data-adjacent features are IP-geolocation enrichment and an opt-in analytics heartbeat.
Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
Spring Security is a comprehensive authentication and authorization library for Spring-based applications, supporting both Servlet (MVC) and Reactive (WebFlux) stacks. In production, it intercepts HTTP requests via a configurable filter chain (SecurityFilterChain for servlet, WebFilterChain for reactive) to enforce authentication, session management, CSRF protection, security headers, CORS, and access control. It provides a pluggable architecture with core abstractions (AuthenticationManager, AuthorizationManager, SecurityContextHolderStrategy) and protocol-specific modules for OAuth2/OIDC, SAML2, LDAP, CAS, WebAuthn, Kerberos, and JWT. The library is configured via annotations (@EnableWebSecurity, @EnableMethodSecurity), a Kotlin DSL, or XML namespace, and integrates deeply with Spring's configuration and dependency injection. The architecture is modular: the 'core' module defines foundational interfaces (Authentication, GrantedAuthority, SecurityContext), 'web' implements servlet and reactive security filters, 'config' provides annotation-driven and XML configuration support, and protocol modules (oauth2, saml2, ldap, webauthn, cas) handle specific authentication/authorization flows. Key entry points include the HttpSecurity/ServerHttpSecurity builders, SecurityFilterChain, and method-security annotations (@PreAuthorize, @Secured). External dependencies include Spring Framework, Jackson (for serialization), Project Reactor (for reactive support), OpenSAML, and LDAP libraries. The codebase demonstrates strong engineering practices: extensive use of strategy, composite, and builder patterns; clean separation of servlet and reactive APIs; and a consistent Jackson mixin pattern for serialization of security objects.
teams-for-linux is an unofficial, community-maintained Electron desktop client for Microsoft Teams, specifically targeting Linux desktop integration gaps. It wraps the Teams web SPA, adding native features like tray icons, system notifications, WebAuthn/FIDO2 hardware key support, MQTT home-automation integration, multi-account profile switching, custom themes/backgrounds, and an advanced configuration system with deprecation management. The architecture is modular, with a main process (Electron) coordinating IPC-secured preload scripts that inject browser tools into the Teams page. Key subsystems include a centralized config schema (single source of truth), a profile manager for isolated WebContentsView-based accounts, D-Bus and MQTT bridges for external control, and an extensive suite of unit and Playwright e2e tests. The project follows a rigorous ADR-driven decision process, automated release-please releases, and cross-distro Docker-based testing. While tightly coupled to the Teams web app's DOM and internal APIs, the codebase demonstrates high engineering craftsmanship with clear separation of concerns, security hardening (IPC allowlist, PII sanitization), and reusable patterns (secure dialogs, browser tool init pattern).
This is a monorepo for Auth.js (formerly NextAuth.js), a framework-agnostic authentication library for web applications. The core engine (`@auth/core`) handles OAuth/OIDC, email/passwordless, credentials, and WebAuthn/Passkey authentication flows. It provides a unified API for session management (JWT or database-backed), CSRF protection, and cookie handling. The library is designed to be integrated into multiple frameworks via separate packages: `@auth/nextjs`, `@auth/sveltekit`, `@auth/express`, `@auth/qwik`, and `@auth/solid-start`. Each framework package adapts the core `Auth` function to the framework's request/response model, offering server-side handlers, middleware, and client-side hooks. The repository also includes over 80 built-in OAuth/OIDC provider definitions (e.g., Google, GitHub, Discord, Auth0) and 20+ database adapters (e.g., Prisma, Drizzle, MongoDB, PostgreSQL, DynamoDB) that implement a standard `Adapter` interface for user persistence. The project is now part of Better Auth, and the README recommends new projects use Better Auth unless specific feature gaps exist. The monorepo contains development apps, example applications, and a comprehensive documentation site built with Nextra.
Hanko is a production-grade, self-hostable authentication and identity platform written primarily in Go. The backend exposes public, admin, and management HTTP APIs plus a CLI for migrations, user import/export, JWK/JWT management, and config schema generation. Authentication is implemented as a custom state-machine engine (flowpilot) driving login, registration, password/passkey/MFA/third-party OAuth/SAML flows, backed by JWT sessions, device trust, webhooks, audit logs, and rate limiting. The persistence layer uses gobuffalo/pop with a broad set of per-entity persister interfaces and roughly 65 Fizz migrations covering users, emails, credentials, sessions, tenants, organizations, roles, SAML providers, and webhooks. The frontend is split into a TypeScript SDK (`@teamhanko/hanko-frontend-sdk`) and Preact-based web components (`@teamhanko/hanko-elements`) that render flow states into embeddable `<hanko-auth>` and `<hanko-profile>` elements. The repository also contains a quickstart Go server, framework examples for React, Vue, Angular, Next.js, and Express, Playwright e2e tests, Docker Compose stacks, and Kubernetes manifests. Data flows through Echo routers into flowpilot actions/hooks, which validate inputs, persist state, issue sessions, and trigger webhook events; PostgreSQL, Redis, SMTP, and external OAuth/SAML providers are the primary external dependencies. Overall the codebase is well-structured and heavily tested, with sophisticated security handling around redirect validation, account linking, multi-tenant isolation, and webhook signing. The main friction points are the custom flowpilot framework's learning curve, a very large configuration surface, duplicated example code, and some stale example/e2e toolchains relative to the core Go and Node versions.
This repository is a Payload CMS authentication plugin (payload-auth-plugin) that provides OAuth2, OIDC, password, and passkey authentication strategies. It is designed to be used with Payload CMS v3+ and integrates deeply with Payload's admin panel and frontend via custom API endpoints, collection field injection, and a client-side library. The plugin supports multiple providers (Google, GitHub, Apple, etc.) via a clean provider factory pattern and manages its own session cookies, credential hashing (PBKDF2), and account linking. The architecture is a plugin that hooks into Payload's lifecycle, extending the CMS with authentication endpoints and database collections. The example application (examples/with-website/) demonstrates a full Payload CMS + Next.js website with admin and public authentication flows. Despite being pre-1.0, the codebase exhibits solid engineering patterns: strategy pattern for endpoint registration, collection helper functions that merge user-defined configs, and a reusable AuthClient class for browser-side authentication. However, it lacks automated tests, has several FIXME comments in passkey and password protocols, and is tightly coupled to Payload's internal DB and cookie mechanisms, which introduces technical drift risk as Payload evolves. The plugin is actively maintained with frequent releases and a changelog documenting 50+ versions.
This is a fully-featured OAuth2 and OpenID Connect authentication and authorization server built with Node.js/TypeScript and the Curveball framework. It provides user management, role-based access control, multi-factor authentication (TOTP, WebAuthn), and an administrative web UI. The project is self-contained with its own database migrations, CLI binary, and Docker support. It supports multiple database backends (PostgreSQL, MySQL, SQLite) via Knex. The codebase is well-structured following a modular architecture with clear separation between controllers, services, and format handlers. It implements the OAuth2 authorization framework including authorization code, client credentials, implicit, and refresh token grants with PKCE support. The OpenID Connect layer provides discovery, JWKS, and userinfo endpoints. Authentication is modular with pluggable challenge strategies for passwords, TOTP, email OTP, and WebAuthn. The project is retired, as explicitly stated in the README, and the authors recommend migrating to Keycloak. Despite being deprecated, the code remains a solid reference implementation for OAuth2/OIDC in Node.js and contains several reusable components including an abstract key-value store, an SMS adapter pattern, and cryptographic utilities.