Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM
See the code
Rauthy (spoken like "RAW-thy" (rôthē) from "Auth"entication) - Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, and PAM
[!NOTE] This application received an independent security audit from Radically Open Security (Frank Plattel and Morgan Hill) as part of the NGI Zero Core funding. There were some findings that were addressed in
v0.32.1. The full report can be found here.
Rauthy is a lightweight and easy to use Identity Provider supporting OpenID Connect, OAuth 2, and PAM. It aims to be simple to both set up and operate, with very secure defaults and lots of config options, if you need the flexibility. It puts heavy emphasis on Passkeys and a very strong security in general. The project is written in Rust to be as memory efficient, secure, and fast as possible, and it can run on basically any hardware. If you need Single Sign-On support for IoT or headless CLI tools, it's got you covered as well.
You get High-Availability, client branding, UI translation, a nice Admin UI, Events and Auditing, and many more features. By default, it runs on top of Hiqlite and does not depend on an external database (Postgres as an alternative) to make it even simpler to operate, while scaling up to millions of users easily.
It tries to be as secure as possible by default while still providing all the options needed to be
compatible with older systems. For instance, if you create a new OIDC client, it activates ed25519
as the default algorithm for token signing and S256 PKCE flow. This will not work with clients,
which do not support it, but you can of course deactivate this to your liking.
Option 1:
Password + Security Key (without User Verification):
Rauthy provides FIDO 2 / Webauthn login flows. If you once logged in on a new client with your
username and password, you will get an encrypted cookie which will allow you to log in without a
password from that moment on. You only need to have a FIDO compliant Passkey being registered for
your account.
Option 2:
Passkey-Only Accounts:
Rauthy supports Passkey-Only-Accounts: you provide your E-Mail address and log in with your FIDO 2
Passkey. Your account will not even have / need a password. This login flow is restricted, though,
to only those passkeys that can provide User Verification (UV) to always have at least 2FA security.
[!NOTE] The user can choose between default Passkeys that do not use a storage slot on the device, and discoverable credentials, which will use a storage slot, but can be used for a direct login without any E-Mail necessary. Since this can brick some older hardware keys, it is an opt-in, and it shows a warning message before registration.
The main goal was to provide an SSO solution like Keycloak and others while using a way lower footprint and being more efficient with resources. For instance, Rauthy can easily run a fully blown SSO provider on just a Raspberry Pi. It makes extensive use of caching for everything used in the authentication chain to be as fast as possible. Most things are even cached for several hours and special care has been taken into account in case of cache eviction and invalidation.
Rauthy comes with two database options:
The resource usage depends a lot on your setup (Hiqlite, Postgres, HA deployment, number of users, ...). However, if you apply memory allocator tuning from the book, and you have a small set of users, it usually looks like this:
If you enable the SwaggerUI or the embedded IPGeo DB, they will consume quite a bit more idle memory.
Even though it makes extensive use of caching, you can run it in HA mode with external dependencies. Hiqlite creates its own embedded HA cache and persistence layer. Such a deployment is possible with both Hiqlite and Postgres.
Rauthy does have an Admin UI which can be used to basically do almost any operation you might need to administrate the whole application and its users. There is also an account dashboard for each user, where users will get a basic overview over their account and can self-manage some values, password, passkeys, and so on.
You have a simple way to create a branding or stylized look for the Login page for each client. The
whole color theme can be changed, and each client can have its own custom logo and browser favicon
for its Login page. Additionally, the theme and logo of the default rauthy client are also used
for the Account and Admin page.
Rauthy comes with an Event- and Alerting-System. Events are generated in all kinds of scenarios. They can be sent via E-Mail, Matrix, or Slack, depending on the severity and the configured level. You will see them in the Admin UI in real-time, or you can subscribe to the events stream and externally handle them depending on your own business logic.
Rauthy has brute-force, credential stuffing, and basic DoS protection for the login endpoint. The timeout will be artificially delayed after enough invalid logins. It auto-blacklists IPs that exceeded too many invalid logins, with automatic expiry of the blacklisting. You can, if you like, manually blacklist certain IPs as well via the Admin UI.
On top of that, Rauthy can block requests depending on geolocation data. It can either grab that information from a custom header, e.g. when your CDN provides it, or you can add a Maxmind account to the config, and Rauthy will download a database automatically.
With the possibility to run on devices with very limited resources and having compatibility for the
OAuth Device Authorization Grant device_code flow, Rauthy would be a very good choice for IoT
projects. The IdP itself can easily run on a Raspberry Pi, and all headless devices can be
authenticated via the device_code flow. The rauthy-client has everything built-in and ready, if
you want to use Rust on the IoT devices as well. It has not been checked in a no_std environment
yet, but the client implementation is pretty simple.
OIDC / OAuth covers almost all web apps, and for those that don't have any support, Rauthy comes
with forward_auth support. To not need an additional LDAP / AD / something similar for your
backend and workstations, Rauthy comes with its own custom PAM module. It does not just use JWT
Tokens for logging in, but you can actually manage all your Linux hosts, groups, and users in
different ways. You have the option to secure local logins to workstations via Yubikey (only USB
Passkeys supported, no QR-code / software keys) All SSH logins can be done with ephemeral,
auto-expiring passwords, that you can generate via your Account dashboard, or via SSH public key.
The only prerequisite is that an Admin created a PAM user for the account. This means you have
MFA-secured SSH logins without the need for any modifications or additional software on your local
SSH client, and you can use any SSH client from any machine securely, even if it's not your own.
In addition to the PAM module, you get an NSS module and an NSS proxy that runs on each machine. You can dynamically log in to any machine an Admin has given you access to. Users and groups are not added to local files but will be resolved via the network.
This module is published in a separate repo to avoid licensing issues, since it relies on some GPLv3 dependencies. You can take a look at it here: rauthy-pam-nss.
Rauthy has no issue handling even millions of users. Everything keeps being fast and responsive,
apart from the search function for users in the Admin UI when you reach the 10+ million users, where
searching usually takes ~3 seconds (depending on your server, of course).
The only limiting factor at that point will be your configuration and needs for password hashing
security. It really depends on how many resources you want to use for hashing (more resources ==
more secure) and how many concurrent logins at the exact same time you need to support.
forward_auth endpoint, in addition to the existing userinfo, with support for
configurable trusted auth headers/metrics endpoint on separate portwebid documentEither just take a look at the Rauthy Book, or start directly
by taking a look at the application yourself with docker on your localhost. Rauthy comes with a
setting for very quick and easy local testing and taking a first look. By setting LOCAL_TEST=true,
a demo config is being loaded at startup.
docker run -it --rm -e LOCAL_TEST=true -p 8443:8443 ghcr.io/sebadob/rauthy:0.37.1
[!CAUTION] When you add the
LOCAL_TEST=truevar, it will ONLY work onlocalhost! Under the hood, Rauthy loads a very minimal (and unsafe) demo config. If you want to test anywhere else thanlocalhost, you need to set up a proper config.
[!NOTE] Some browsers like Firefox do not allow the registration of Passkeys when using self-signed TLS certificates. To be able to do this during testing, you would need to add the generated CA certificate to your trust store.
[!TIP] This command starts an HTTPS server with self-signed certificates.
Make sure to add thehttps://scheme if you open the URL manually.
If you need professional (paid) support for Rauthy, please feel free to contact me at
mail@sebadob.dev. Otherwise, please use the Discussions Q&A section. Opened issues, which are
actually just support requests, will most probably not be answered at all. I am working on this
project mostly in my free time.
If you want to contribute to this repository, please take a look at CONTRIBUTING.md
This project was funded through NGI Zero Core, a fund established by NLnet with financial support from the European Commission's Next Generation Internet program. Learn more at the NLnet project page.
(top 24 of 61)
2,200 followers · starred Sep 2025
603 followers · starred Apr 2025
552 followers · starred Feb 2025
1,088 followers · starred Feb 2026
Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM
See the code
Rauthy (spoken like "RAW-thy" (rôthē) from "Auth"entication) - Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, and PAM
[!NOTE] This application received an independent security audit from Radically Open Security (Frank Plattel and Morgan Hill) as part of the NGI Zero Core funding. There were some findings that were addressed in
v0.32.1. The full report can be found here.
Rauthy is a lightweight and easy to use Identity Provider supporting OpenID Connect, OAuth 2, and PAM. It aims to be simple to both set up and operate, with very secure defaults and lots of config options, if you need the flexibility. It puts heavy emphasis on Passkeys and a very strong security in general. The project is written in Rust to be as memory efficient, secure, and fast as possible, and it can run on basically any hardware. If you need Single Sign-On support for IoT or headless CLI tools, it's got you covered as well.
You get High-Availability, client branding, UI translation, a nice Admin UI, Events and Auditing, and many more features. By default, it runs on top of Hiqlite and does not depend on an external database (Postgres as an alternative) to make it even simpler to operate, while scaling up to millions of users easily.
It tries to be as secure as possible by default while still providing all the options needed to be
compatible with older systems. For instance, if you create a new OIDC client, it activates ed25519
as the default algorithm for token signing and S256 PKCE flow. This will not work with clients,
which do not support it, but you can of course deactivate this to your liking.
Option 1:
Password + Security Key (without User Verification):
Rauthy provides FIDO 2 / Webauthn login flows. If you once logged in on a new client with your
username and password, you will get an encrypted cookie which will allow you to log in without a
password from that moment on. You only need to have a FIDO compliant Passkey being registered for
your account.
Option 2:
Passkey-Only Accounts:
Rauthy supports Passkey-Only-Accounts: you provide your E-Mail address and log in with your FIDO 2
Passkey. Your account will not even have / need a password. This login flow is restricted, though,
to only those passkeys that can provide User Verification (UV) to always have at least 2FA security.
[!NOTE] The user can choose between default Passkeys that do not use a storage slot on the device, and discoverable credentials, which will use a storage slot, but can be used for a direct login without any E-Mail necessary. Since this can brick some older hardware keys, it is an opt-in, and it shows a warning message before registration.
The main goal was to provide an SSO solution like Keycloak and others while using a way lower footprint and being more efficient with resources. For instance, Rauthy can easily run a fully blown SSO provider on just a Raspberry Pi. It makes extensive use of caching for everything used in the authentication chain to be as fast as possible. Most things are even cached for several hours and special care has been taken into account in case of cache eviction and invalidation.
Rauthy comes with two database options:
The resource usage depends a lot on your setup (Hiqlite, Postgres, HA deployment, number of users, ...). However, if you apply memory allocator tuning from the book, and you have a small set of users, it usually looks like this:
If you enable the SwaggerUI or the embedded IPGeo DB, they will consume quite a bit more idle memory.
Even though it makes extensive use of caching, you can run it in HA mode with external dependencies. Hiqlite creates its own embedded HA cache and persistence layer. Such a deployment is possible with both Hiqlite and Postgres.
Rauthy does have an Admin UI which can be used to basically do almost any operation you might need to administrate the whole application and its users. There is also an account dashboard for each user, where users will get a basic overview over their account and can self-manage some values, password, passkeys, and so on.
You have a simple way to create a branding or stylized look for the Login page for each client. The
whole color theme can be changed, and each client can have its own custom logo and browser favicon
for its Login page. Additionally, the theme and logo of the default rauthy client are also used
for the Account and Admin page.
Rauthy comes with an Event- and Alerting-System. Events are generated in all kinds of scenarios. They can be sent via E-Mail, Matrix, or Slack, depending on the severity and the configured level. You will see them in the Admin UI in real-time, or you can subscribe to the events stream and externally handle them depending on your own business logic.
Rauthy has brute-force, credential stuffing, and basic DoS protection for the login endpoint. The timeout will be artificially delayed after enough invalid logins. It auto-blacklists IPs that exceeded too many invalid logins, with automatic expiry of the blacklisting. You can, if you like, manually blacklist certain IPs as well via the Admin UI.
On top of that, Rauthy can block requests depending on geolocation data. It can either grab that information from a custom header, e.g. when your CDN provides it, or you can add a Maxmind account to the config, and Rauthy will download a database automatically.
With the possibility to run on devices with very limited resources and having compatibility for the
OAuth Device Authorization Grant device_code flow, Rauthy would be a very good choice for IoT
projects. The IdP itself can easily run on a Raspberry Pi, and all headless devices can be
authenticated via the device_code flow. The rauthy-client has everything built-in and ready, if
you want to use Rust on the IoT devices as well. It has not been checked in a no_std environment
yet, but the client implementation is pretty simple.
OIDC / OAuth covers almost all web apps, and for those that don't have any support, Rauthy comes
with forward_auth support. To not need an additional LDAP / AD / something similar for your
backend and workstations, Rauthy comes with its own custom PAM module. It does not just use JWT
Tokens for logging in, but you can actually manage all your Linux hosts, groups, and users in
different ways. You have the option to secure local logins to workstations via Yubikey (only USB
Passkeys supported, no QR-code / software keys) All SSH logins can be done with ephemeral,
auto-expiring passwords, that you can generate via your Account dashboard, or via SSH public key.
The only prerequisite is that an Admin created a PAM user for the account. This means you have
MFA-secured SSH logins without the need for any modifications or additional software on your local
SSH client, and you can use any SSH client from any machine securely, even if it's not your own.
In addition to the PAM module, you get an NSS module and an NSS proxy that runs on each machine. You can dynamically log in to any machine an Admin has given you access to. Users and groups are not added to local files but will be resolved via the network.
This module is published in a separate repo to avoid licensing issues, since it relies on some GPLv3 dependencies. You can take a look at it here: rauthy-pam-nss.
Rauthy has no issue handling even millions of users. Everything keeps being fast and responsive,
apart from the search function for users in the Admin UI when you reach the 10+ million users, where
searching usually takes ~3 seconds (depending on your server, of course).
The only limiting factor at that point will be your configuration and needs for password hashing
security. It really depends on how many resources you want to use for hashing (more resources ==
more secure) and how many concurrent logins at the exact same time you need to support.
forward_auth endpoint, in addition to the existing userinfo, with support for
configurable trusted auth headers/metrics endpoint on separate portwebid documentEither just take a look at the Rauthy Book, or start directly
by taking a look at the application yourself with docker on your localhost. Rauthy comes with a
setting for very quick and easy local testing and taking a first look. By setting LOCAL_TEST=true,
a demo config is being loaded at startup.
docker run -it --rm -e LOCAL_TEST=true -p 8443:8443 ghcr.io/sebadob/rauthy:0.37.1
[!CAUTION] When you add the
LOCAL_TEST=truevar, it will ONLY work onlocalhost! Under the hood, Rauthy loads a very minimal (and unsafe) demo config. If you want to test anywhere else thanlocalhost, you need to set up a proper config.
[!NOTE] Some browsers like Firefox do not allow the registration of Passkeys when using self-signed TLS certificates. To be able to do this during testing, you would need to add the generated CA certificate to your trust store.
[!TIP] This command starts an HTTPS server with self-signed certificates.
Make sure to add thehttps://scheme if you open the URL manually.
If you need professional (paid) support for Rauthy, please feel free to contact me at
mail@sebadob.dev. Otherwise, please use the Discussions Q&A section. Opened issues, which are
actually just support requests, will most probably not be answered at all. I am working on this
project mostly in my free time.
If you want to contribute to this repository, please take a look at CONTRIBUTING.md
This project was funded through NGI Zero Core, a fund established by NLnet with financial support from the European Commission's Next Generation Internet program. Learn more at the NLnet project page.
(top 24 of 61)
2,200 followers · starred Sep 2025
603 followers · starred Apr 2025
552 followers · starred Feb 2025
1,088 followers · starred Feb 2026