BLA (Blind LLM Agents) is the open-source Blue Defense MCP and CLI built to protect software artifacts against automated AI reverse-engineering workflows.
dumbtv takes the ads, screen tracking and update nags out of your Fire TV over ADB. No root, none of your apps touched, every step can be undone. Free and open source.
Protect your Node.js projects from supply chain attacks. Scan npm packages for malware, crypto-drainers, and security vulnerabilities with AI-powered threat intelligence.
Rauthy is a lightweight and easy to use Identity Provider supporting OpenID Connect, OAuth 2, and
PAM. It aims to be simple to both set up and operate, with very secure defaults and lots of config
options, if you need the flexibility. It puts heavy emphasis on Passkeys and a very strong security
in general. The project is written in Rust to be as memory efficient, secure, and fast as possible,
and it can run on basically any hardware. If you need Single Sign-On support for IoT or headless CLI
tools, it's got you covered as well.
You get High-Availability, client branding, UI translation, a nice Admin UI, Events and Auditing,
and many more features. By default, it runs on top of Hiqlite
and does not depend on an external database (Postgres as an alternative) to make it even simpler to
operate, while scaling up to millions of users easily.
Secure by default
It tries to be as secure as possible by default while still providing all the options needed to be
compatible with older systems. For instance, if you create a new OIDC client, it activates ed25519
as the default algorithm for token signing and S256 PKCE flow. This will not work with clients,
which do not support it, but you can of course deactivate this to your liking.
MFA and Passwordless Login
Option 1:
Password + Security Key (without User Verification):
Rauthy provides FIDO 2 / Webauthn login flows. If you once logged in on a new client with your
username and password, you will get an encrypted cookie which will allow you to log in without a
password from that moment on. You only need to have a FIDO compliant Passkey being registered for
your account.
Option 2:
Passkey-Only Accounts:
Rauthy supports Passkey-Only-Accounts: you provide your E-Mail address and log in with your FIDO 2
Passkey. Your account will not even have / need a password. This login flow is restricted, though,
to only those passkeys that can provide User Verification (UV) to always have at least 2FA security.
[!NOTE]
The user can choose between default Passkeys that do not use a storage slot on the device, and
discoverable credentials, which will use a storage slot, but can be used for a direct login
without any E-Mail necessary. Since this can brick some older hardware keys, it is an opt-in, and
it shows a warning message before registration.
Fast and efficient
The main goal was to provide an SSO solution like Keycloak and others while using a way lower
footprint and being more efficient with resources. For instance, Rauthy can easily run a fully blown
SSO provider on just a Raspberry Pi. It makes extensive use of caching for everything used in the
authentication chain to be as fast as possible. Most things are even cached for several hours and
special care has been taken into account in case of cache eviction and invalidation.
Rauthy comes with two database options:
with embedded Hiqlite, which is the default setting
or you can optionally use a Postgres as your database, if you already have an instance running
anyway.
The resource usage depends a lot on your setup (Hiqlite, Postgres, HA deployment, number of
users, ...). However, if you apply memory allocator tuning from the book, and you have a small set
of users, it usually looks like this:
Hiqlite single instance ~40mb
Hiqlite HA cluster ~65mb
Postgres-based ~35mb
If you enable the SwaggerUI or the embedded IPGeo DB, they will consume quite a bit more idle
memory.
Highly Available
Even though it makes extensive use of caching, you can run it in HA mode with external
dependencies. Hiqlite creates its own embedded HA cache and
persistence layer. Such a deployment is possible with
both Hiqlite and Postgres.
Admin UI + User Account Dashboard
Rauthy does have an Admin UI which can be used to basically do almost any operation you might need
to administrate the whole application and its users. There is also an account dashboard for each
user, where users will get a basic overview over their account and can self-manage some values,
password, passkeys, and so on.
Client Branding
You have a simple way to create a branding or stylized look for the Login page for each client. The
whole color theme can be changed, and each client can have its own custom logo and browser favicon
for its Login page. Additionally, the theme and logo of the default rauthy client are also used
for the Account and Admin page.
Events and Auditing
Rauthy comes with an Event- and Alerting-System. Events are generated in all kinds of scenarios.
They can be sent via E-Mail, Matrix, or Slack, depending on the severity and the configured level.
You will see them in the Admin UI in real-time, or you can subscribe to the events stream and
externally handle them depending on your own business logic.
Brute-Force, Credential Stuffing, basic DoS protection, Geo-Blocking
Rauthy has brute-force, credential stuffing, and basic DoS protection for the login endpoint. The
timeout will be artificially delayed after enough invalid logins. It auto-blacklists IPs that
exceeded too many invalid logins, with automatic expiry of the blacklisting. You can, if you like,
manually blacklist certain IPs as well via the Admin UI.
On top of that, Rauthy can block requests depending on geolocation data. It can either grab that
information from a custom header, e.g. when your CDN provides it, or you can add
a Maxmind account to the config, and Rauthy will download a
database automatically.
IoT Ready
With the possibility to run on devices with very limited resources and having compatibility for the
OAuth Device Authorization Grant device_code flow, Rauthy would be a very good choice for IoT
projects. The IdP itself can easily run on a Raspberry Pi, and all headless devices can be
authenticated via the device_code flow. The rauthy-client has everything built-in and ready, if
you want to use Rust on the IoT devices as well. It has not been checked in a no_std environment
yet, but the client implementation is pretty simple.
PAM Logins
OIDC / OAuth covers almost all web apps, and for those that don't have any support, Rauthy comes
with forward_auth support. To not need an additional LDAP / AD / something similar for your
backend and workstations, Rauthy comes with its own custom PAM module. It does not just use JWT
Tokens for logging in, but you can actually manage all your Linux hosts, groups, and users in
different ways. You have the option to secure local logins to workstations via Yubikey (only USB
Passkeys supported, no QR-code / software keys) All SSH logins can be done with ephemeral,
auto-expiring passwords, that you can generate via your Account dashboard, or via SSH public key.
The only prerequisite is that an Admin created a PAM user for the account. This means you have
MFA-secured SSH logins without the need for any modifications or additional software on your local
SSH client, and you can use any SSH client from any machine securely, even if it's not your own.
In addition to the PAM module, you get an NSS module and an NSS proxy that runs on each machine. You
can dynamically log in to any machine an Admin has given you access to. Users and groups are not
added to local files but will be resolved via the network.
This module is published in a separate repo to avoid licensing issues, since it relies on some GPLv3
dependencies. You can take a look at it
here: rauthy-pam-nss.
Scales to millions of users
Rauthy has no issue handling even millions of users. Everything keeps being fast and responsive,
apart from the search function for users in the Admin UI when you reach the 10+ million users, where
searching usually takes ~3 seconds (depending on your server, of course).
The only limiting factor at that point will be your configuration and needs for password hashing
security. It really depends on how many resources you want to use for hashing (more resources ==
more secure) and how many concurrent logins at the exact same time you need to support.
Account conversions between traditional password and Passkey only
Optional open user registration
Optional user registration domain restriction
App version update checker
SwaggerUI documentation
Configurable E-Mail templates for NewPassword + ResetPassword events
Prometheus /metrics endpoint on separate port
No-Setup migrations between different databases (Yes, even
between Hiqlite
and Postgres)
Hot-Reload TLS certificates without restart
Can serve a basic webid document
Experimental FedCM support
Getting Started
Either just take a look at the Rauthy Book, or start directly
by taking a look at the application yourself with docker on your localhost. Rauthy comes with a
setting for very quick and easy local testing and taking a first look. By setting LOCAL_TEST=true,
a demo config is being loaded at startup.
docker run -it --rm -e LOCAL_TEST=true -p 8443:8443 ghcr.io/sebadob/rauthy:0.37.2
[!CAUTION]
When you add the LOCAL_TEST=true var, it will ONLY work on localhost! Under the hood, Rauthy
loads a very minimal (and unsafe) demo config. If you want to test anywhere else than localhost,
you need to set up a proper config.
[!NOTE]
Some browsers like Firefox do not allow the registration of Passkeys when using self-signed TLS
certificates. To be able to do this during testing, you would need to add the generated CA
certificate to your trust store.
[!TIP]
This command starts an HTTPS server with self-signed certificates.
Make sure to add the https:// scheme if you open the URL manually.
Support
If you need professional (paid) support for Rauthy, please feel free to contact me at
[email protected]. Otherwise, please use the Discussions Q&A section. Opened issues, which are
actually just support requests, will most probably not be answered at all. I am working on this
project mostly in my free time.
Contributing
If you want to contribute to this repository, please take a look at
CONTRIBUTING.md
