OpenID Connect (OIDC)

OpenID Connect (OIDC) is a standard for authentication and authorization built on top of OAuth.

It allows for Single Sign On (SSO) and it consolidate users in a single place, similar to LDAP. Unlike LDAP, you can have SSO, Multi-Factor Authentication, Passkeys, and more.

Nowadays, it's the industry standard.

Review the specification

OIDC can be divided in 2 parts

1. Identity Providers (IdP): Servers that hold the users. For example: Google or Github are IdPs, which you can use to log-in into an app. At the same time, you can run your own IdP, and connect your applications to it.
2. OIDC Client: Services that speak the protocol, and once configured, they can connect to an IdP.

Identity Providers

This is a list of some of the open source IdP available in nixos. If listed, then it's available, at least, as a package.

Name	nixos module	Language	Wiki	TOTP	Passkeys	LDAP	PAM
Zitadel	services.zitadel	Go	Zitadel	✅	✅	✅	❌
Kanidm	services.kanidm	Rust		✅	✅	✅	✅
Dex	services.dex	Go		❌*	❌*	✅	❌
Tinyauth	services.tinyauth	Go		✅	❌	✅	❌
Rauthy		Rust		❌	✅	❌	✅
Authentik	nix-community/authentik-nix	Go		✅	✅	✅	✅
PockedID	services.pocket-id	Go	Pocket ID	❌	✅	✅	❌

TODO: Complete unknowns❓

\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support