Sign inSign up

schiplat/signet

By schiplat

•Updated 21 days ago

Lightweight unified identity authentication (SSO / OIDC IdP) service

Image
Security
API management
0

285

schiplat/signet repository overview

⁠Signet

Unified identity authentication (SSO / OIDC IdP) service. https://github.com/schiplat/signet/⁠

Language: English · 简体中文⁠

  • Production entry (future): https://sso.example.com
  • Default dev Issuer: http://localhost:8443 (configurable via SIGNET_ISSUER)
  • First integrating app: Cella (internal subsystem); clients register through the generic channel (Dashboard → Clients or RFC 7591 dynamic registration), with no built-in presets

Naming note: this project is an SSO, not Alibaba Cloud Object Storage (OSS).

⁠Documentation

DocumentContents
docs/design.md⁠Overall design, roles, security, roadmap
docs/security.md⁠Security design summary (credential storage, auth, sessions, MFA, OIDC, audit, keys)
docs/client-integration.md⁠Client OIDC integration (authorize/token/PKCE/IP allowlist)
docs/integrations.md⁠Integrations (RFC 7591 dynamic registration · Webhooks/Feishu · SCIM v2)
docs/api-v1.md⁠Dashboard HTTP API (unified /api/v1/...)
docs/mfa.md⁠TOTP / recovery codes / global & per-user enforcement
docs/dashboard.md⁠Dashboard pages & permissions

⁠Local development

⁠1. Configuration
cp .env.example .env
# Edit SIGNET_DATABASE_URL, etc.

On first run with no admin, open the dashboard in a browser. It redirects to /setup, where you create the first administrator account (email, optional display name, and password).

⁠2. Backend
cargo run -p signet

Health check: GET http://localhost:8443/health

⁠3. Dashboard (Vue)
cd dashboard
pnpm install
pnpm dev          # http://localhost:5173, proxied to :8443
# or build and embed into the binary:
pnpm build
cd .. && cargo build -p signet

In production/staging, Rust serves dashboard/dist via rust-embed.

⁠4. Account model
  • No public registration; staff accounts are provisioned under Dashboard → Users (frontend route /users, API /api/v1/admin/users)
  • Roles: admin / manager / member (see design doc)
  • First-run /setup page creates the initial admin
  • Optional MFA (global or per-user enforced); users may self-enroll from the account menu
⁠5. Observability
  • Every request/response carries x-request-id (passed through or auto-generated UUIDv4) for trace linking
  • Access logs are emitted uniformly by crates/signet/src/access_log.rs: single line, structured fields (request_id / method / path / query / ip / status / latency_ms), with 2xx/3xx at INFO, 4xx at WARN, 5xx at ERROR
  • Logging goes through tracing; see .cursor/rules/logging.mdc⁠: static messages + structured fields, errors in an error field, single-line JSON in production (APP_ENV=production)
  • GET /metrics exposes Prometheus metrics

⁠Main endpoints

PathDescription
GET /healthHealth check
GET /metricsPrometheus metrics (public)
GET /.well-known/openid-configurationOIDC Discovery
GET /oauth/authorizeAuthorization (redirects to /login if not signed in, /consent if not consented)
POST /oauth/tokenToken exchange (code + PKCE / refresh)
POST /oauth/consentConsent submission
GET /oauth/jwksJWKS
GET /oauth/userinfoUserInfo (includes groups)
GET/POST /oauth/end_sessionSingle logout
POST /oauth/revokeRFC 7009 revocation
POST /oauth/registerRFC 7591 dynamic client registration
GET /api/v1/setup/statusFirst-run setup probe (needs_setup)
POST /api/v1/setupCreate the first admin on first run
POST /api/v1/password-reset/*Password reset (request/confirm)
GET/POST/DELETE /api/v1/me/passkeys/*Passkey (WebAuthn) register/sign-in/manage
/scim/v2/*SCIM v2 user/group sync (Bearer auth)
/api/v1/*Dashboard / session / admin API (unified prefix, see api-v1.md⁠)

Examples: POST /api/v1/login, GET /api/v1/admin/users, GET /api/v1/admin/stats.

⁠Repository structure

crates/signet/     Axum OIDC IdP + /api/v1
dashboard/         Vue 3 + Tailwind CSS v4
migrations/        Postgres migrations (MFA, audit IP, client IP allowlist, password reset, webhook, SCIM, WebAuthn)
docs/              design · security · client-integration · integrations · api-v1 · mfa · dashboard

Tag summary

Content type

Image

Digest

sha256:0bceb88f4…

Size

38.4 MB

Last updated

21 days ago

docker pull schiplat/signet