An OpenID Connect and FAPI 2 Relying Party module for Apache HTTPd, enabling standards-based authentication and authorization.
mod_auth_openidc is an Apache HTTPd module that implements the OpenID Connect and FAPI 2 Relying Party specifications. It enables Apache web servers to authenticate users via external OpenID Connect Providers, providing a standards-based single sign-on solution. It solves the problem of integrating modern identity protocols into Apache-protected applications and services.
System administrators and DevOps engineers who manage Apache HTTPd servers and need to add secure, standards-based authentication to web applications or APIs. It is also relevant for organizations migrating legacy applications to OpenID Connect.
Developers choose mod_auth_openidc because it is OpenID Certified™, supports the latest security standards like FAPI 2.0, and allows adding authentication to existing applications without code changes via Apache's reverse proxy capabilities. Its extensive provider support and clustering features make it production-ready.
OpenID Certified™ OpenID Connect and FAPI 2 Relying Party module for Apache HTTPd
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
It's OpenID Certified™ and supports a wide range of specifications including FAPI 2.0, ensuring standards-based interoperability with providers like Keycloak and Azure AD.
By configuring Apache as a reverse proxy, it can add OpenID Connect authentication to existing applications without modifying their code, as emphasized in the README.
Supports claims-based authorization using Apache's Require directives, allowing precise access control based on identity token and userinfo claims.
Offers configurable cache backends for session storage, enabling clustering and high-availability deployments, which is documented in the Wiki.
Tightly coupled to Apache HTTPd, making it unsuitable for environments using Nginx, Caddy, or other web servers, limiting deployment flexibility.
Setting up OIDC flows, provider metadata, and cache backends requires meticulous Apache configuration, which can be error-prone and time-consuming.
Advanced features like Redis over TLS and support for Redis Sentinel/Cluster are locked behind a commercial license, fragmenting the open-source offering.