OpenID Connect (OIDC) - Revision history

Woile: typo

2026-08-26T08:26:31Z

typo

← Older revision		Revision as of 08:26, 26 August 2026
Line 9:		Line 9:
	OIDC can be divided in 2 parts		OIDC can be divided in 2 parts

	# '''Identity Providers (IdP)''': Servers ~~the~~ hold the users. For example: Google or Github are IdPs, which you can use to log-in into an app. At the same time, you can run your own IdP, and connect your applications to it.		# '''Identity Providers (IdP)''': Servers that hold the users. For example: Google or Github are IdPs, which you can use to log-in into an app. At the same time, you can run your own IdP, and connect your applications to it.
	# '''OIDC Client''': Services that speak the protocol, and once configured, they can connect to an IdP.		# '''OIDC Client''': Services that speak the protocol, and once configured, they can connect to an IdP.

Woile: updated table

2026-08-24T09:41:06Z

updated table

← Older revision		Revision as of 09:41, 24 August 2026
Line 23:		Line 23:
	!Passkeys		!Passkeys
	!LDAP		!LDAP
			!PAM
	\|-		\|-
	\|[https://zitadel.com/ Zitadel]		\|[https://zitadel.com/ Zitadel]
Line 31:		Line 32:
	\|✅		\|✅
	\|✅		\|✅
			\|❌
	\|-		\|-
	\|[https://kanidm.com/ Kanidm]		\|[https://kanidm.com/ Kanidm]
Line 36:		Line 38:
	\|Rust		\|Rust
	\|		\|
			\|✅
	\|✅		\|✅
	\|✅		\|✅
Line 47:		Line 50:
	\|❌*		\|❌*
	\|✅		\|✅
			\|❌
	\|-		\|-
	\|[https://tinyauth.app/ Tinyauth]		\|[https://tinyauth.app/ Tinyauth]
Line 52:		Line 56:
	\|Go		\|Go
	\|		\|
	\|❓		\|✅
	\|❓		\|❌
	\|❓		\|❌
			\|❌
	\|-		\|-
	\|[https://sebadob.github.io/rauthy/ Rauthy]		\|[https://sebadob.github.io/rauthy/ Rauthy]
Line 60:		Line 65:
	\|Rust		\|Rust
	\|		\|
			\|❌
	\|✅		\|✅
			\|❌
	\|✅		\|✅
	\|❌
	\|-		\|-
	\|[https://goauthentik.io/ Authentik]		\|[https://goauthentik.io/ Authentik]
	\|		\|[https://github.com/nix-community/authentik-nix nix-community/authentik-nix]
	\|Go		\|Go
	\|		\|
	\|❓		\|✅
	\|❓		\|✅
	\|❓		\|✅
			\|✅
	\|}		\|}
	TODO: Complete unknowns❓		TODO: Complete unknowns❓

	\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support		\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support

Woile: Woile moved page OpenID Connect to OpenID Connect (OIDC): Make it easier to find

2026-08-24T08:14:08Z

Woile moved page OpenID Connect to OpenID Connect (OIDC): Make it easier to find

← Older revision		Revision as of 08:14, 24 August 2026
(No difference)

Woile: OIDC dedicated page, which a lot of applications use, now users can find a page with an intro

2026-08-24T07:59:23Z

OIDC dedicated page, which a lot of applications use, now users can find a page with an intro

New page

[https://openid.net/ OpenID Connect] (OIDC) is a standard for authentication and authorization built on top of [https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1 OAuth].

It allows for [[wikipedia:Single_sign-on|Single Sign On]] (SSO) and it consolidate users in a single place, similar to LDAP. Unlike LDAP, you can have SSO, Multi-Factor Authentication, Passkeys, and more.

Nowadays, it's the industry standard.

[https://openid.net/specs/openid-connect-core-1_0-final.html Review the specification]

OIDC can be divided in 2 parts

# '''Identity Providers (IdP)''': Servers the hold the users. For example: Google or Github are IdPs, which you can use to log-in into an app. At the same time, you can run your own IdP, and connect your applications to it.
# '''OIDC Client''': Services that speak the protocol, and once configured, they can connect to an IdP.

==== Identity Providers ====
This is a list of some of the open source IdP available in nixos. If listed, then it's available, at least, as a package.
{| class="wikitable"
|+
!Name
!nixos module
!Language
!Wiki
!TOTP
!Passkeys
!LDAP
|-
|[https://zitadel.com/ Zitadel]
|<code>services.zitadel</code>
|Go
|[[Zitadel]]
|✅
|✅
|✅
|-
|[https://kanidm.com/ Kanidm]
|<code>services.kanidm</code>
|Rust
|
|✅
|✅
|✅
|-
|[https://dexidp.io/ Dex]
|<code>services.dex</code>
|Go
|
|❌*
|❌*
|✅
|-
|[https://tinyauth.app/ Tinyauth]
|<code>services.tinyauth</code>
|Go
|
|❓
|❓
|❓
|-
|[https://sebadob.github.io/rauthy/ Rauthy]
|
|Rust
|
|✅
|✅
|❌
|-
|[https://goauthentik.io/ Authentik]
|
|Go
|
|❓
|❓
|❓
|}
TODO: Complete unknowns❓

\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support