solarssk/ssf-transmitter

By solarssk

•Updated 13 days ago

Self-hosted Shared Signals Framework bridge for Authentik.

Image

Security

Integration & delivery

2.8K

Overview Tags

solarssk/ssf-transmitter repository overview

⁠SSF Transmitter

Self-hosted Shared Signals Framework bridge for Authentik. Pushes real-time session-revoked and credential-change events straight to Apple Business Manager, or any SSF receiver, no SaaS relay in between.

Full documentation, source, and the Wiki live on GitHub: github.com/solarssk/ssf-transmitter⁠.

⁠What it does

Standalone service that sits next to Authentik and forwards user security events (logout, password change) to receivers implementing the OpenID Shared Signals Framework. It exists so that pushing SSF events out of Authentik doesn't mean building and maintaining that integration yourself, or paying for a relay you don't control.

There's no admin UI: everything is configured through environment variables, and one container runs one active SSF stream at a time. Registering a new receiver replaces the existing stream. An optional background loop can also keep an Apple Business Manager user directory in sync via SCIM.

⁠How it works

Authentik fires a webhook on logout or password change.
The event is mapped to a CAEP session-revoked or credential-change type.
It's signed as an RS256 JWT (a Security Event Token).
The signed SET is pushed over HTTPS to every enabled stream's receiver.

⁠Features

	Feature	What it does
📡	SSF discovery and JWKS	Standard `.well-known/ssf-configuration` and `jwks.json` so receivers auto-discover and verify signatures.
🛠️	Stream management API	Create, read, update, and delete the single active SSF stream over a management Bearer token.
🗺️	CAEP event mapping	Logout and password-change Authentik events map to `session-revoked` and `credential-change` SETs.
✍️	RS256-signed delivery	Every push is revalidated against SSRF and DNS-rebinding checks right before it goes out.
🔒	Encrypted receiver tokens	Fernet-encrypted at rest; management and webhook tokens never touch disk.
🕵️	PII masked by default	Email addresses are pseudonymised in logs unless explicitly opted out.
👥	Apple SCIM user sync	Optional directory sync from Authentik to Apple Business Manager, scoped to a single group if you want.

⁠Stack

	Layer	Technologies
🐍	Runtime	Python 3.14, FastAPI + Uvicorn
🗄️	Storage	SQLite via `aiosqlite`
🔐	Crypto	`cryptography` (RS256 JWT signing, Fernet token encryption)
🛡️	CI/CD security	CodeQL, Trivy (CRITICAL gate), SonarCloud, `pip-audit`, CycloneDX SBOM per platform

⁠Quick start

docker run -d \
  -p 8000:8000 \
  -v ssf-keys:/app/keys \
  -v ssf-data:/app/data \
  -e SSF_ISSUER=https://idp.example.com/shared-signals \
  -e SSF_BASE_URL=https://idp.example.com/shared-signals \
  -e SSF_MANAGEMENT_TOKEN=<openssl rand -hex 32> \
  -e SSF_WEBHOOK_TOKEN=<openssl rand -hex 32> \
  solarssk/ssf-transmitter:latest

Full deployment guide (Docker Compose, Nginx Proxy Manager, Authentik webhook setup): docs/Deployment.md⁠.

⁠Image tags

solarssk/ssf-transmitter:X.Y.Z   # pinned release, e.g. 0.5.12
solarssk/ssf-transmitter:latest  # tracks the most recent stable release

Multi-arch manifest (linux/amd64 + linux/arm64) — Docker pulls the one matching your host automatically. Every image passes a Trivy CRITICAL-vulnerability gate before it's pushed, and the same content is also published to ghcr.io/solarssk/ssf-transmitter (private; docker login ghcr.io required).

⁠Links

⁠License

MIT⁠

Tag summary

Recent tags

Content type

Image

Digest

sha256:0b87313ec…

Size

59.5 MB

Last updated

13 days ago

docker pull solarssk/ssf-transmitter