steveiliop56/tinyauth

Features

• Edge Security Enforcements - Acts as an authentication gateway that verifies identities and enforces access policies at the network boundary before traffic reaches backends.
• OIDC Identity Token Issuance - Acts as an OpenID Connect provider that manages client registrations and issues standardized identity tokens.
• OpenID Connect Providers - Functions as a central OpenID Connect provider to enable single sign-on experiences across multiple applications.
• Reverse Proxy Authentication - Acts as an authentication gateway that intercepts requests to validate identity before forwarding traffic to backend services.
• Authentication Middleware - Provides a standalone server or middleware component for verifying identity and authorization on incoming requests.
• Credential Hashing - Secures user passwords by storing one-way salted bcrypt hashes instead of plain text.
• External Identity Provider Integration - Delegates identity verification and user authentication to external providers using OAuth and LDAP.
• OAuth and Identity Providers - Delegates user authentication and identity verification to OAuth 2.0 or OpenID Connect compliant providers.
• OAuth Provider Integrations - Provides standardized interfaces for registering and managing OAuth-based authentication providers.
• Credential Validation - Validates user identities via local passwords, Basic Auth, LDAP, or external OIDC providers to grant system access.
• LDAP Authentication - Delegates user authentication and group authorization to an external directory server using LDAP search filters.
• Multi-Factor Authentication - Implements a secondary security layer by validating time-synchronized one-time passwords (TOTP).
• Multi-Factor Authentication Providers - Provides a security service that implements time-based one-time passwords for secondary identity verification.
• OAuth Authentication - Operates as a central gateway delegating user verification to external providers via OAuth 2.0.
• OIDC Identity Integrations - Delegates authentication to external OpenID Connect servers to manage secure network access.
• Password Verification - Verifies provided usernames and passwords against stored bcrypt hashes with optional TOTP validation.
• Reverse Proxy Security - Secures backend applications by offloading authentication and access control to a reverse proxy.
• Session Authentication - Manages secure user sessions by handling the login process and issuing session cookies.
• Single Sign-On - Provides a centralized login experience across multiple applications using the OpenID Connect protocol.
• Third-Party Authentication Providers - Integrates with external OAuth identity providers to allow users to sign in with third-party accounts.
• Multi-Provider Authentication - Supports authentication across multiple third-party identity providers using configurable credentials.
• Two-Factor Authentication - Implements two-factor authentication using time-based one-time passwords from authenticator apps.
• Identity Header Injections - Injects authenticated user and group metadata into request headers for downstream application authorization.
• Request Interception Middleware - Operates as an authentication gateway that intercepts requests and validates credentials before forwarding traffic to backends.
• Secret Generation - The Authelia server creates a time-based one-time password secret and QR code to enable multi-factor authentication for a user.
• Session Storage - Enhances security and state persistence by storing user session data in a persistent database.
• Authentication Integration - Integrates with Kubernetes ingress controllers via annotations to forward authentication checks to the server.
• Group-Based Access Controls - Grants access to authorized users by validating membership in specific OIDC or LDAP groups.
• Application Access Controls - Defines granular permission rules for applications based on identity, groups, IP addresses, or request paths.
• Client Registration Protocols - Implements standardized procedures for onboarding and registering client applications within the OIDC system.
• Identity-Based Access Control - Blocks or allows application access based on user lists, email patterns, or group memberships.
• Identity Provider Integrations - Synchronizes and forwards user identities and group memberships from OIDC or LDAP providers to applications.
• Path-Based Access Rules - Uses regular expression matching to define which URL paths require authentication or remain public.
• Session Security Policies - Provides configurable security policies for sessions, including expiry, lifetimes, and secure cookie requirements.
• Cross-Subdomain Session Management - Maintains a single authenticated user session across different subdomains by configuring shared cookies at the parent domain level.
• Cross-Subdomain Session Sharing - Shares authentication state across multiple subdomains by setting session cookies on the common parent domain.
• User-Based Access Restrictions - Provides the ability to block or allow specific user identities and OAuth emails from accessing applications.
• Group Access Controls - Restricts application access by extracting and validating group memberships from an LDAP provider.
• IP Access Restrictions - Restricts or allows traffic based on IP addresses and CIDR subnets to manage trusted access.

Star-Verlauf