Rauthy
Rauthy (spoken like "RAW-thy" (rôthē) from "Auth"entication) - Single Sign-On Identity & Access
Management via OpenID Connect, OAuth 2, and PAM
[!NOTE]
This application received an independent security audit
from Radically Open Security
(Frank Plattel and Morgan Hill) as part
of the NGI Zero Core funding. There were some findings that were
addressed in v0.32.1. The full report can be found
here.
What it is
Rauthy is a lightweight and easy to use Identity Provider supporting OpenID Connect, OAuth 2, and
PAM. It aims to be simple to both set up and operate, with very secure defaults and lots of config
options, if you need the flexibility. It puts heavy emphasis on Passkeys and a very strong security
in general. The project is written in Rust to be as memory efficient, secure, and fast as possible,
and it can run on basically any hardware. If you need Single Sign-On support for IoT or headless CLI
tools, it's got you covered as well.
You get High-Availability, client branding, UI translation, a nice Admin UI, Events and Auditing,
and many more features. By default, it runs on top of Hiqlite
and does not depend on an external database (Postgres as an alternative) to make it even simpler to
operate, while scaling up to millions of users easily.
Secure by default
It tries to be as secure as possible by default while still providing all the options needed to be
compatible with older systems. For instance, if you create a new OIDC client, it activates ed25519
as the default algorithm for token signing and S256 PKCE flow. This will not work with clients,
which do not support it, but you can of course deactivate this to your liking.
MFA and Passwordless Login
Option 1:
Password + Security Key (without User Verification):
Rauthy provides FIDO 2 / Webauthn login flows. If you once logged in on a new client with your
username and password, you will get an encrypted cookie which will allow you to log in without a
password from that moment on. You only need to have a FIDO compliant Passkey being registered for
your account.
Option 2:
Passkey-Only Accounts:
Rauthy supports Passkey-Only-Accounts: you provide your E-Mail address and log in with your FIDO 2
Passkey. Your account will not even have / need a password. This login flow is restricted, though,
to only those passkeys that can provide User Verification (UV) to always have at least 2FA security.
[!NOTE]
The user can choose between default Passkeys that do not use a storage slot on the device, and
discoverable credentials, which will use a storage slot, but can be used for a direct login
without any E-Mail necessary. Since this can brick some older hardware keys, it is an opt-in, and
it shows a warning message before registration.
Fast and efficient
The main goal was to provide an SSO solution like Keycloak and others while using a way lower
footprint and being more efficient with resources. For instance, Rauthy can easily run a fully blown
SSO provider on just a Raspberry Pi. It makes extensive use of caching for everything used in the
authentication chain to be as fast as possible. Most things are even cached for several hours and
special care has been taken into account in case of cache eviction and invalidation.
Rauthy comes with two database options:
- with embedded Hiqlite, which is the default setting
- or you can optionally use a Postgres as your database, if you already have an instance running
anyway.
The resource usage depends a lot on your setup (Hiqlite, Postgres, HA deployment, number of
users, ...). However, if you apply memory allocator tuning from the book, and you have a small set
of users, it usually looks like this:
- Hiqlite single instance ~40mb
- Hiqlite HA cluster ~65mb
- Postgres-based ~35mb
If you enable the SwaggerUI or the embedded IPGeo DB, they will consume quite a bit more idle
memory.
Highly Available
Even though it makes extensive use of caching, you can run it in HA mode with external
dependencies. Hiqlite creates its own embedded HA cache and
persistence layer. Such a deployment is possible with
both Hiqlite and Postgres.
Admin UI + User Account Dashboard
Rauthy does have an Admin UI which can be used to basically do almost any operation you might need
to administrate the whole application and its users. There is also an account dashboard for each
user, where users will get a basic overview over their account and can self-manage some values,
password, passkeys, and so on.
Client Branding
You have a simple way to create a branding or stylized look for the Login page for each client. The
whole color theme can be changed, and each client can have its own custom logo and browser favicon
for its Login page. Additionally, the theme and logo of the default rauthy client are also used
for the Account and Admin page.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
