OpenID Connect (OIDC): Difference between revisions
m Woile moved page OpenID Connect to OpenID Connect (OIDC): Make it easier to find |
m updated table |
||
| Line 23: | Line 23: | ||
!Passkeys | !Passkeys | ||
!LDAP | !LDAP | ||
!PAM | |||
|- | |- | ||
|[https://zitadel.com/ Zitadel] | |[https://zitadel.com/ Zitadel] | ||
| Line 31: | Line 32: | ||
|✅ | |✅ | ||
|✅ | |✅ | ||
|❌ | |||
|- | |- | ||
|[https://kanidm.com/ Kanidm] | |[https://kanidm.com/ Kanidm] | ||
| Line 36: | Line 38: | ||
|Rust | |Rust | ||
| | | | ||
|✅ | |||
|✅ | |✅ | ||
|✅ | |✅ | ||
| Line 47: | Line 50: | ||
|❌* | |❌* | ||
|✅ | |✅ | ||
|❌ | |||
|- | |- | ||
|[https://tinyauth.app/ Tinyauth] | |[https://tinyauth.app/ Tinyauth] | ||
| Line 52: | Line 56: | ||
|Go | |Go | ||
| | | | ||
| | |✅ | ||
| | |❌ | ||
| | |❌ | ||
|❌ | |||
|- | |- | ||
|[https://sebadob.github.io/rauthy/ Rauthy] | |[https://sebadob.github.io/rauthy/ Rauthy] | ||
| Line 60: | Line 65: | ||
|Rust | |Rust | ||
| | | | ||
|❌ | |||
|✅ | |✅ | ||
|❌ | |||
|✅ | |✅ | ||
|- | |- | ||
|[https://goauthentik.io/ Authentik] | |[https://goauthentik.io/ Authentik] | ||
| | |[https://github.com/nix-community/authentik-nix nix-community/authentik-nix] | ||
|Go | |Go | ||
| | | | ||
| | |✅ | ||
| | |✅ | ||
| | |✅ | ||
|✅ | |||
|} | |} | ||
TODO: Complete unknowns❓ | TODO: Complete unknowns❓ | ||
\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support | \* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support | ||
Revision as of 09:41, 24 August 2026
OpenID Connect (OIDC) is a standard for authentication and authorization built on top of OAuth.
It allows for Single Sign On (SSO) and it consolidate users in a single place, similar to LDAP. Unlike LDAP, you can have SSO, Multi-Factor Authentication, Passkeys, and more.
Nowadays, it's the industry standard.
OIDC can be divided in 2 parts
- Identity Providers (IdP): Servers the hold the users. For example: Google or Github are IdPs, which you can use to log-in into an app. At the same time, you can run your own IdP, and connect your applications to it.
- OIDC Client: Services that speak the protocol, and once configured, they can connect to an IdP.
Identity Providers
This is a list of some of the open source IdP available in nixos. If listed, then it's available, at least, as a package.
| Name | nixos module | Language | Wiki | TOTP | Passkeys | LDAP | PAM |
|---|---|---|---|---|---|---|---|
| Zitadel | services.zitadel
|
Go | Zitadel | ✅ | ✅ | ✅ | ❌ |
| Kanidm | services.kanidm
|
Rust | ✅ | ✅ | ✅ | ✅ | |
| Dex | services.dex
|
Go | ❌* | ❌* | ✅ | ❌ | |
| Tinyauth | services.tinyauth
|
Go | ✅ | ❌ | ❌ | ❌ | |
| Rauthy | Rust | ❌ | ✅ | ❌ | ✅ | ||
| Authentik | nix-community/authentik-nix | Go | ✅ | ✅ | ✅ | ✅ |
TODO: Complete unknowns❓
\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support