OpenID Connect (OIDC)
OpenID Connect (OIDC) is a standard for authentication and authorization built on top of OAuth.
It allows for Single Sign On (SSO) and it consolidate users in a single place, similar to LDAP. Unlike LDAP, you can have SSO, Multi-Factor Authentication, Passkeys, and more.
Nowadays, it's the industry standard.
OIDC can be divided in 2 parts
- Identity Providers (IdP): Servers that hold the users. For example: Google or Github are IdPs, which you can use to log-in into an app. At the same time, you can run your own IdP, and connect your applications to it.
- OIDC Client: Services that speak the protocol, and once configured, they can connect to an IdP.
Identity Providers
This is a list of some of the open source IdP available in nixos. If listed, then it's available, at least, as a package.
| Name | nixos module | Language | Wiki | TOTP | Passkeys | LDAP | PAM |
|---|---|---|---|---|---|---|---|
| Zitadel | services.zitadel
|
Go | Zitadel | ✅ | ✅ | ✅ | ❌ |
| Kanidm | services.kanidm
|
Rust | ✅ | ✅ | ✅ | ✅ | |
| Dex | services.dex
|
Go | ❌* | ❌* | ✅ | ❌ | |
| Tinyauth | services.tinyauth
|
Go | ✅ | ❌ | ✅ | ❌ | |
| Rauthy | Rust | ❌ | ✅ | ❌ | ✅ | ||
| Authentik | nix-community/authentik-nix | Go | ✅ | ✅ | ✅ | ✅ | |
| PockedID | services.pocket-id
|
Go | Pocket ID | ❌ | ✅ | ✅ | ❌ |
TODO: Complete unknowns❓
\* Dex is more like an OIDC proxy, it can support if you configure other provider, but the built in doesn't seem to support