pocket-id/pocket-id
Pocket Id
Pocket ID is a self-hosted OpenID Connect (OIDC) identity provider that replaces traditional passwords with passkey-based authentication using WebAuthn public-key cryptography. It runs as a standalone service on user-managed infrastructure, eliminating shared secrets entirely by authenticating users through passkeys instead of passwords.
The project distinguishes itself through security-hardened deployment patterns, including distroless container images, non-root user execution, and read-only root filesystems to reduce the attack surface. It supports configurable token signing algorithms (RSA, ECDSA, or EdDSA) with user-defined key sizes and rotation capabilities, along with wildcard callback URL matching and user group access restrictions for OIDC clients.
Beyond core authentication, Pocket ID provides user and group management through LDAP directory synchronization, a REST API for automation, and flexible registration workflows including manual creation, invitation links, or open registration. It includes audit logging for security monitoring, anonymous usage telemetry for instance counting, and email notifications for sign-ins from unrecognized devices. The project is deployed as a containerized service with documented setup guides for integrating with third-party applications.
Features
- OIDC Protocol Implementations - Implements the OpenID Connect protocol to issue identity tokens and authenticate users across third-party applications.
- OpenID Connect Providers - Ships a lightweight OpenID Connect provider for self-hosted authentication with configurable token signing.
- Self-Hosted Deployments - Runs as a standalone, self-hosted service that manages user authentication without external dependencies.
- Configurable Signing Algorithms - Provides configurable token signing algorithms with RSA, ECDSA, or EdDSA and user-defined key sizes.
- OIDC Authentication Plugins - Delegates user authentication to a lightweight OpenID Connect provider that other services trust for identity verification.
- OIDC Identity Integrations - Configures third-party applications to accept passkey-based logins through OpenID Connect protocol integration.
- Token Signing Services - Signs authentication tokens using RSA, ECDSA, or EdDSA algorithms with configurable key rotation.
- Client Registrations - Registers and configures third-party services as OIDC clients for passkey-based authentication.
- OpenID Connect Providers - Acts as an OIDC-compatible identity provider that authenticates users with passkeys instead of passwords.
- Passkey Authentication - Provides passkey-based authentication using WebAuthn public-key cryptography for self-hosted services.
- WebAuthn Authentications - Authenticates users using WebAuthn public-key cryptography instead of passwords, eliminating shared secrets.
- Passkey-Based - Signs in to multiple self-hosted applications using a single passkey-based identity.
- OIDC Callback URL Wildcards - Matches OIDC client callback URLs against wildcard patterns to accept multiple redirect URIs from a single entry.
- Registration Workflows - Creates users manually, generates sign-up links, or enables open registration to fit organizational needs.
- User Management APIs - Uses a documented API to create integrations, automate user management, and build custom workflows.
- Distroless Base Images - Uses a distroless base image that excludes shells and system libraries to minimize the attack surface.
- Distroless Container Deployments - Deploys the application on a distroless container image to minimize the attack surface.
- Group-Based Access Controls - Limits which user groups may authenticate to an OIDC client, blocking all others from accessing the application.
- Algorithm Selection Interfaces - Selects the cryptographic algorithm and key size for token signing, including RSA, ECDSA, or EdDSA.
- Signing Key Rotation - Regenerates the private key used to sign tokens, invalidating all previously issued tokens.
- Non-Root Container Execution Environments - Runs the container as a non-root user to enforce least-privilege access and reduce attack surface.
- User Synchronization - Imports users and groups from an LDAP server to keep identity data synchronized across systems.
- Container Security Hardening - Hardens the container by running as a non-root user with a distroless image and read-only root filesystem.
- Read-Only Filesystem Enforcement - Marks the container's root filesystem as read-only, allowing writes only to explicitly mounted data volumes.
- Automated - Manages users and groups through a REST API and LDAP synchronization for self-hosted environments.
- Audit Logs - Records important events globally and per user in comprehensive logs for monitoring and compliance.
- Authentication Services - Simple OIDC provider supporting passkey-based authentication.
