klardo/ident

By klardo

•Updated 2 days ago

OAuth 2.0 / OpenID Connect authorization server: multi-realm, static binary, MongoDB-backed

Image

2.3K

Overview Tags

klardo/ident repository overview

⁠KlardoIdent

An OAuth 2.0 / OpenID Connect authorization server. Multi-realm, static binary, MongoDB-backed.

Releases and changelog: https://klardo-ident.com/releases.html⁠
Support: [email protected]⁠ · security issues: [email protected]⁠

⁠Quick reference

Maintained by: Klardo GmbH
Supported architectures: linux/amd64, linux/arm64
Tags: X.Y.Z (immutable release) and X.Y (moves with each patch)
- There is no :latest and no bare :X tag during the 0.x beta. Under 0.x a minor bump is allowed to break, so a tag that follows minors would walk your install through a breaking change unannounced.
- X.Y.Z is the reproducible pin. X.Y is the auto-update channel: it moves only with patches, which never break.
Requires: MongoDB started with --replSet (transactions need a replica set)
Exposes: 8080
Signed: cosign keyless, per repository

⁠Quick start

docker run -p 8080:8080 \
  -e MONGO_URI="mongodb://host.docker.internal:27017/kident?replicaSet=rs0" \
  -e SERVER_URL="http://localhost:8080" \
  -e JWT_SECRET="$(openssl rand -base64 48)" \
  -e ADMIN_EMAIL="[email protected]" \
  -e ADMIN_PASSWORD="$(openssl rand -base64 24)" \
  klardo/ident:0.4

First start creates the master realm from ADMIN_EMAIL / ADMIN_PASSWORD.

curl -fsS http://localhost:8080/health
curl http://localhost:8080/realms/master/.well-known/openid-configuration

⁠Realms

Every route is namespaced under its realm; master is the admin realm.

/realms/{realm}/.well-known/openid-configuration
/realms/{realm}/.well-known/jwks.json
/realms/{realm}/authorize
/realms/{realm}/token
/realms/{realm}/userinfo

⁠Configuration (essentials)

Variable	Default	Notes
`MONGO_URI`	—	Required. Must point at a replica set.
`MONGO_DB_NAME`	`oauth`	Database name.
`SERVER_URL`	`http://localhost:8080`	Public URL; becomes the token `iss`.
`PORT`	`8080`	Listen port.
`JWT_SECRET`	—	Required in production. Long random value.
`ENVIRONMENT`	`development`	Set to `production` in production.
`ADMIN_EMAIL` / `ADMIN_PASSWORD`	`[email protected]` / `password`	Master admin, first boot only. Change these.
`ADMIN_CLIENT_SECRET`, `ACCOUNT_CLIENT_SECRET`	—	Set in production.
`ADMIN_UI_ORIGIN`	empty	Origins seeded onto new realms' admin client.
`RATE_LIMIT_ENABLED`	`true`	With `RATE_LIMIT_RPS` / `RATE_LIMIT_BURST`, per IP.
`LICENSE_FILE`	`/etc/kident/license.lic`	Path to a signed licence.

Mail delivery is off until EMAIL_ENABLED=true; it then needs EMAIL_HOST, EMAIL_PORT, EMAIL_USERNAME, EMAIL_PASSWORD, EMAIL_FROM. Cookie behaviour follows COOKIE_SECURE (forced on over HTTPS) and COOKIE_SAMESITE. The complete reference, including the connected-install licensing variables, ships as the README inside the on-prem package.

⁠Admin UI

The web console ships separately as klardo/ident-admin-ui, served on its own origin. Register that origin once per realm:

kident admin-origin set --realm master --url https://admin.example.com

⁠Verifying an image

docker buildx imagetools inspect docker.io/klardo/ident:0.4 --format '{{.Manifest.Digest}}'

cosign verify docker.io/klardo/ident:0.4 \
  --certificate-identity-regexp '^https://github.com/klardo-gmbh/identcontrol/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The signing identity is the release workflow in the (private) build repository — the certificate is what you verify against, no repository access needed.

⁠Licence

Commercial software, © Klardo GmbH. The licence terms ship with the image and with the on-prem package. Evaluation and subscription terms: https://klardo-ident.com⁠.

Tag summary

Recent tags

Content type

Image

Digest

sha256:fa0eb82fd…

Size

7.7 MB

Last updated

2 days ago

docker pull klardo/ident:0.5