Keycloak is a production-grade open-source Identity and Access Management (IAM) server. In production it provides authentication and authorization for applications via OIDC/OAuth2, SAML, and emerging standards including OID4VC verifiable credentials (SD-JWT, mdoc, LDP), Shared Signals Framework (SSF/CAEP/RISC), WebAuthn passkeys, and CIBA. The server is a modular Java monolith running on Quarkus, exposing REST admin APIs (v1 plus a feature-gated v2), protocol endpoints, and React-based admin/account consoles, with a Kubernetes operator for managed deployment and CLI tools (kc.sh, kcadm.sh, kcreg.sh). The architecture is built around a pervasive SPI/provider-factory pattern: nearly every subsystem (authentication flows, password hashing, event listeners, user storage federation, token introspection, crypto providers, theme selection) is pluggable via ProviderFactory + Spi interfaces, making the system highly extensible. Persistence uses JPA/Hibernate with Liquibase migrations across PostgreSQL, MySQL, MariaDB, Oracle, and MSSQL; distributed caching and cluster events use Infinispan. The codebase also ships Java and TypeScript admin client libraries and legacy WildFly SAML adapters. Primary data flows: browser/device authentication flows produce signed tokens (access, refresh, ID, userinfo) via pluggable crypto providers (BouncyCastle, FIPS 140-2, Elytron); user/session state flows between the database and Infinispan caches with invalidation events; identity brokering federates users from LDAP, Kerberos, and social IdPs; admin operations emit admin and audit events. Test infrastructure is extensive: a new JUnit 5 test framework with DI annotations coexists with a legacy Arquillian suite (migration in progress), plus Playwright e2e tests for the admin UI. This is purely an application repository - no data pipelines or research artifacts. Notable reusable components include a self-contained SD-JWT implementation, a JOSE/JWS/JWK library, and generic utilities (PathMatcher, Retry) that could be extracted into other Java projects with minimal modification.
Cerbos is an open-source, cloud-native authorization engine (Policy Decision Point) that evaluates access policies at runtime. It processes authorization requests via gRPC and HTTP APIs, enforcing policies defined in YAML using RBAC, ABAC, and derived roles. The system ingests policies from multiple storage backends (disk, Git, SQL databases, cloud blob storage, Cerbos Hub) and compiles them into an optimized rule table with a bitmap-based index for low-latency evaluation. The rule table uses CEL (Common Expression Language) for condition evaluation, with partial evaluation for query planning. Architecturally, Cerbos is a Go monorepo producing two main binaries: `cerbos` (server + CLI tools) and `cerbosctl` (admin CLI). The server exposes gRPC/HTTP endpoints for CheckResources and PlanResources, along with admin, playground, and AuthZEN-compliant APIs. It includes built-in observability with OpenTelemetry metrics/tracing, structured logging, audit logging (local, Kafka, Hub), and telemetry. The evaluation engine is highly optimized with lazy dimension materialization, program caching, and functional core sharing to minimize memory and latency. External dependencies include protobuf, gRPC, CEL, OpenTelemetry, and various storage drivers (PostgreSQL, MySQL, SQLite, Kafka, BadgerDB, cloud SDKs). The project is designed for Kubernetes deployment (sidecar, service, daemonset), AWS Lambda, and systemd. It also provides a CLI for policy management, testing, and debugging, including a REPL for interactive condition evaluation.
Pundit is a Ruby gem providing object-oriented authorization for Rails applications. It defines policy classes (plain Ruby objects) with query methods like `update?` and scope classes for scoping records. The core is a `Pundit::Context` that handles authorization, policy finding, and caching. It integrates with Rails controllers via `Pundit::Authorization` mixin, offering `authorize`, `policy`, `policy_scope`, and strong parameter helpers. It includes RSpec matchers for testing policies and generators for Rails. The architecture is clean, well-tested, and actively maintained.
Better Auth is a framework-agnostic authentication and authorization framework for TypeScript, designed as a monorepo with a core library, multiple database adapters (Drizzle, Prisma, Kysely, MongoDB, in-memory), client SDKs (React, Vue, Svelte, Solid, Expo, Electron), and a plugin ecosystem. It supports email/password, OAuth2/OIDC, SAML, SCIM, passkeys, 2FA, phone number OTP, and more. The architecture is modular: the core package provides the `betterAuth()` function, which configures plugins, database adapters, and social providers, and exposes a REST API for authentication flows. Client libraries use nanostores for reactive state management. The CLI offers project scaffolding, migration generation, and schema validation. External dependencies include jose for JWT, zod for validation, and various ORMs for database access. The codebase is well-tested with unit, integration, and e2e tests across all packages, and includes a release tooling package with AI-assisted changelog generation.
Authelia is a self-hosted, open-source authentication and authorization server providing single sign-on (SSO), multi-factor authentication (MFA), and access control for reverse proxies. The backend is written in Go, using fasthttp for HTTP, koanf for configuration, and supports multiple storage backends (SQLite, PostgreSQL, MySQL) and authentication backends (LDAP, file-based, PAM). It implements a full OpenID Connect 1.0 / OAuth 2.0 provider with certified conformance, WebAuthn (FIDO2) passkeys, TOTP, Duo Push, and passwordless authentication. The frontend is a React/TypeScript single-page application with i18n, custom UI components, and integration with the backend via REST APIs. The architecture follows a service-oriented pattern with middleware chains, configuration validation, and extensive unit and integration tests. The codebase is well-structured, modular, and demonstrates high craftsmanship in areas like timing attack mitigation, clock abstraction for testability, and configuration validation.
Spring Security is a comprehensive authentication and authorization library for Spring-based applications, supporting both Servlet (MVC) and Reactive (WebFlux) stacks. In production, it intercepts HTTP requests via a configurable filter chain (SecurityFilterChain for servlet, WebFilterChain for reactive) to enforce authentication, session management, CSRF protection, security headers, CORS, and access control. It provides a pluggable architecture with core abstractions (AuthenticationManager, AuthorizationManager, SecurityContextHolderStrategy) and protocol-specific modules for OAuth2/OIDC, SAML2, LDAP, CAS, WebAuthn, Kerberos, and JWT. The library is configured via annotations (@EnableWebSecurity, @EnableMethodSecurity), a Kotlin DSL, or XML namespace, and integrates deeply with Spring's configuration and dependency injection. The architecture is modular: the 'core' module defines foundational interfaces (Authentication, GrantedAuthority, SecurityContext), 'web' implements servlet and reactive security filters, 'config' provides annotation-driven and XML configuration support, and protocol modules (oauth2, saml2, ldap, webauthn, cas) handle specific authentication/authorization flows. Key entry points include the HttpSecurity/ServerHttpSecurity builders, SecurityFilterChain, and method-security annotations (@PreAuthorize, @Secured). External dependencies include Spring Framework, Jackson (for serialization), Project Reactor (for reactive support), OpenSAML, and LDAP libraries. The codebase demonstrates strong engineering practices: extensive use of strategy, composite, and builder patterns; clean separation of servlet and reactive APIs; and a consistent Jackson mixin pattern for serialization of security objects.
Apache Shiro is a mature Java security framework and library, not an end-user application. It provides authentication, authorization, session management, and cryptography through a modular Maven multi-module architecture. The central abstractions are SecurityManager, Subject, Realm, Authenticator, Authorizer, and SessionManager, backed by pluggable implementations such as JDBC, LDAP, Active Directory, and text-based realms. The web module adds servlet filters, filter-chain management, JSP/JSF tags, and path-matching URL security, while support modules integrate with Spring, Spring Boot, Guice, CDI, JAX-RS, AspectJ, Quartz, and Jakarta EE. The crypto modules offer modern password hashing (Argon2, BCrypt), legacy SHA hashing, symmetric ciphers, and hash format serialization. The framework is embeddable via programmatic configuration, annotation-driven AOP interceptors, or the legacy INI-based configuration path, which is now deprecated in favor of environment-based setup. The codebase is heavily tested with unit tests and container-based integration tests, and core interfaces remain small and clean; however, it carries noticeable legacy baggage including deprecated factories, duplicated JSP/JSF tag implementations, mixed mocking frameworks, and numerous support modules that require ongoing maintenance to avoid drift. It has no data pipelines or research components; all data-related code is limited to security data sources, caching, and test fixtures.
This is the Symfony Security Core component, a pure PHP library providing a generic, extensible authorization and authentication framework. It is infrastructure code, not an application – it defines interfaces and implementations for token storage, access decision making (with pluggable voters and strategies), role hierarchies, user providers and checkers, signature hashing for secure links, and validation constraints. The architecture relies heavily on design patterns: Strategy (access decision strategies), Chain of Responsibility (user providers/checkers), Decorator (traceable managers, usage tracking token storage), and Template Method (abstract Voter class). It is well-typed with PHP 8.4 features and includes extensive unit tests. The repository also bundles 50+ locale translations for security-related exception messages. It is a mature, actively maintained component that forms the security foundation for Symfony applications.
This repository is a Laravel-specific wrapper library for the core Spatie Menu package. Its primary function is to provide a fluent PHP interface for generating HTML navigation menus within Laravel applications. It extends the base menu functionality by integrating Laravel's routing system, URL generation helpers, Blade view rendering, and the Gate authorization system. The architecture follows standard Laravel package conventions, utilizing a Service Provider for IoC binding and a Facade for static access. The system operates by accepting route names, controller actions, or raw URLs as input, processing them through Laravel's routing and URL helpers, and outputting rendered HTML strings. It handles edge cases such as active state detection based on the current request URL and conditional rendering based on user permissions. The codebase is tightly coupled to the Laravel ecosystem (illuminate/* packages) but maintains a clean separation between the core menu logic (in the spatie/menu dependency) and the Laravel-specific glue code. Maintenance is evidenced by recent commits and a changelog tracking support for Laravel versions 8 through 13, indicating active adaptation to framework updates. The codebase enforces strict coding standards via PHP CS Fixer and utilizes Pest for testing, ensuring consistency and reliability. It is a high-quality utility library designed for reuse in any Laravel project requiring dynamic navigation menus.
Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
Apache Polaris is a production-grade, multi-tenant Iceberg REST catalog server built on Quarkus. It provides a REST API for catalog management (namespaces, tables, views), credential vending for cloud storage (S3, GCS, Azure), fine-grained authorization via built-in RBAC or external OPA/Ranger, and event publishing (Kafka, CloudWatch). The system supports two persistence backends: a legacy relational JDBC (PostgreSQL, H2) and a new NoSQL abstraction with custom indexing, caching, and distributed invalidation. Multi-tenancy is implemented via isolated realms, each with its own configuration and persisted state. Key entry points are the Quarkus server (`polaris-server`), a CLI admin tool, and a Python client. External dependencies include Iceberg libraries, Quarkus, Jackson, Testcontainers, and optional integrations like Open Policy Agent, Apache Ranger, and Kafka. The architecture is modular with clear SPI boundaries, making extensions (persistence, auth, federation) pluggable.
Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
ember-simple-auth is a lightweight Ember.js addon for implementing authentication and authorization in Ember applications. It provides a session service, pluggable authenticators (OAuth2 password grant, implicit grant, Devise, Torii, and custom), and session stores (localStorage, sessionStorage, cookie, adaptive, ephemeral) that persist the session across page reloads and synchronize across browser tabs. The library supports FastBoot, Engines, and Embroider, and includes built-in test helpers. Architecture follows a service-based pattern where the session service delegates to an internal session module that manages state transitions (unauthenticated, authenticated, loading) and communicates with authenticators and stores via events. The codebase is partially migrated to TypeScript, uses modern tooling (pnpm workspaces, Rollup, eslint flat config), and maintains broad compatibility with Ember versions from 3.28 onward.
Athenz is an open-source, fine-grained authorization and identity management platform designed for zero-trust environments. It provides centralized (ZMS) and decentralized (ZTS) services for issuing short-lived X.509 certificates, managing role-based access control (RBAC), and enforcing policies across multi-cloud and on-premise infrastructures. The system supports AWS, GCP, Azure, and Kubernetes workloads through pluggable attestation validators and credential providers, enabling service-to-service authentication and authorization without shared secrets. Architecturally, Athenz comprises three core servers: ZMS (management service for domains, roles, policies), ZTS (token service for certificates, OAuth2 tokens, SSH certs), and MSD (micro-segmentation for network policy management). A React/Next.js UI provides administrative management, while client libraries in Java, Go, and Node.js enable integration. The codebase is organized into modular Maven submodules with RDL-generated data models, extensive unit/integration tests, and Docker/Kubernetes deployment artifacts. Key patterns include factory-based dependency injection (e.g., cert signers, private key stores, notification services), dynamic configuration reloading, and composite validators for cloud attestation. This is a production-grade application with clean abstractions, well-defined interfaces, and significant test coverage. While the codebase contains some generated boilerplate and cloud-specific implementations that may drift, the core libraries and utility classes are reusable and demonstrate strong engineering practices.
laravel-governor is a Laravel package that provides role-based access control (RBAC) with team and ownership support. It integrates with Laravel's native authorization system via policies and gates, offering granular permission management through an admin interface built with Blade templates and Alpine.js. The package includes Eloquent models for roles, permissions, actions, ownership, entities, groups, teams, and assignments, along with migrations, seeders, Artisan commands for setup and publishing, and traits (Governing and Governable) to add authorization capabilities to User and other models. It features a caching layer with automatic invalidation via observers to optimize permission checks, and uses middleware to dynamically register custom policy methods via reflection. The architecture follows Laravel conventions with service providers for booting, controllers for handling requests, and policies for authorization logic.
This repository is a production-grade FastAPI boilerplate (named 'Fastro') designed to accelerate building SaaS backends. It provides a complete, modular architecture with three layers: infrastructure (config, caching, rate limiting, auth, logging, database), interfaces (REST API, admin panel), and vertical-slice modules (user, tier, API keys, rate limits). The codebase is fully async, uses SQLAlchemy 2.0 with `MappedAsDataclass`, Pydantic v2, and FastCRUD for generic CRUD operations. Authentication is session-based via the external `crudauth` library, with server-side sessions, CSRF, OAuth (Google wired), and API key support. Caching and rate limiting follow a provider pattern with swappable Redis/Memcached backends. The repo also includes a CLI tool (`bp`) with plugin discovery for commands and features, a multi-stage Dockerfile, Alembic migrations, and extensive documentation (though some docs describe aspirational features not yet implemented). A paid fork (FastroAI) adds payments, email, and frontend, but the free boilerplate is self-contained and functional.
buji-pac4j is a bridge library that integrates pac4j (a comprehensive security library supporting OAuth, CAS, SAML, OpenID Connect, etc.) with Apache Shiro. It automatically pushes pac4j authentication and authorization profiles into the Shiro security context, allowing developers to use pac4j's wide range of authentication mechanisms while leveraging Shiro for authorization and session management. The bridge is implemented as a set of classes that adapt pac4j's session store, profile manager, and framework adapter to Shiro's APIs, plus a custom Realm, SubjectFactory, and Token. It includes sophisticated logic to avoid unnecessary session renewal when the same user's profiles are updated (e.g., after token refresh), demonstrating deep understanding of both frameworks' internals. The library is production-ready, actively maintained, and used in legacy applications that want to adopt pac4j without fully migrating away from Shiro.
axum-login is a Rust library providing user identification, authentication, and authorization as tower middleware for Axum web applications. It enables pluggable authentication backends through well-designed traits (AuthUser, AuthnBackend, AuthzBackend) and offers flexible route protection via both macro-based and builder-based middleware APIs. The library uses tower-sessions for secure session management and includes features like session fixation mitigation and constant-time password verification. Examples demonstrate usage with various backends including SQLite, OAuth2, and permission-based systems.
RBAC Lookup is a CLI tool for Kubernetes that enables users to find all RoleBindings and ClusterRoleBindings associated with a specific user, service account, or group. The tool connects to a Kubernetes cluster via kubeconfig, queries the RBAC API, and presents the results in a tabular format. It includes optional GKE integration to show Google Cloud IAM roles alongside native Kubernetes RBAC roles. The architecture follows a standard Cobra-based CLI pattern with command definitions in cmd/, core lookup logic in lookup/, and data structures defined in lookup/rbac_subject.go. The tool requires access to a Kubernetes cluster and optionally Google Cloud credentials for GKE features.