How to set up Rauthy for SSH authentication with PAM?

You need to install the separate rauthy-pam-nss module from its GitHub repo, configure it on each Linux host, and create PAM users via Rauthy's Admin UI. This allows SSH logins with ephemeral passwords or Yubikeys, but involves extra steps compared to web OIDC setups.

Rauthy vs Keycloak: which is better for a small team?

Rauthy excels for small teams needing low resource usage and modern features like passkeys out-of-the-box, especially on hardware like Raspberry Pi. Keycloak is better if you require a mature ecosystem with many plugins and broader enterprise integrations, albeit with higher resource consumption.

Can Rauthy integrate with Active Directory for user syncing?

No, Rauthy does not natively sync with AD or LDAP as a primary user source; it manages users internally. For AD integration, you'd need to handle migration or use upstream providers, which might not cover all sync scenarios.

Is Rauthy production-ready for handling millions of users?

Yes, the README states it scales to millions with performance maintained via aggressive caching, though user search in the Admin UI may slow to ~3 seconds at 10+ million users. Deployment with HA and proper database configuration is key.

What were the findings from the independent security audit?

The audit by Radically Open Security found issues addressed in v0.32.1; the full report is linked in the README. It highlights Rauthy's commitment to security, but users should review the report for specific vulnerabilities and fixes.

Does Rauthy support social logins like Google or GitHub?

Yes, via 'Upstream Authentication Providers' feature, allowing login with external services. However, configuration details are less documented compared to core OIDC features, so you might need to rely on community examples or experimentation.

Open-Awesome

Rauthy

Apache-2.0Rustv0.36.0

A lightweight, secure, and efficient open-source Identity Provider supporting OpenID Connect, OAuth 2.0, and PAM authentication.

Visit Website GitHub

1.2k stars113 forks0 contributors

What is Rauthy?

Rauthy is a lightweight, resource-efficient single sign-on (SSO) identity and access management solution built in Rust. It provides a secure OpenID Connect and OAuth 2.0 provider with modern authentication features like passkey-only accounts, designed to be simple to deploy and operate from low-resource hardware like Raspberry Pi to large-scale deployments.

Target Audience

Developers and system administrators needing a lightweight, secure identity provider for web applications, IoT projects, or centralized Linux/SSH authentication without the overhead of traditional solutions like Keycloak.

Value Proposition

Developers choose Rauthy for its low memory footprint (often under 100MB), secure defaults like ed25519 token signing, built-in high availability, and unique features such as custom PAM/NSS modules for Linux system authentication and passkey-only accounts without consuming device storage slots.

Overview

Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM

Use Cases

Best For

Deploying a lightweight SSO provider on resource-constrained hardware like Raspberry Pi for IoT or homelab environments.
Implementing modern passwordless authentication with FIDO2/WebAuthn passkeys, including passkey-only accounts that require user verification.
Centralizing Linux system and SSH authentication across workstations and servers using custom PAM and NSS modules without needing LDAP/AD.
Securing headless CLI tools or IoT devices via OAuth 2.0 Device Authorization Grant (device_code flow).
Running a highly available identity provider that scales to millions of users with optional embedded Hiqlite or Postgres database backends.
Adding client-specific branding and internationalization (i18n) to login pages for multi-tenant applications.

Not Ideal For

Enterprises deeply entrenched in LDAP or Active Directory who need seamless integration without migrating user stores.
Organizations requiring a vast ecosystem of third-party plugins and vendor-specific integrations out-of-the-box.
Projects dependent on niche OIDC/OAuth extensions not yet fully supported, such as certain proprietary SAML fallbacks.
Teams that prioritize Java-based infrastructure and prefer battle-tested, community-heavy solutions like Keycloak for compatibility.

Pros & Cons

Pros

Extreme Resource Efficiency

Built in Rust for minimal footprint, often under 100MB RAM, and can run fully on a Raspberry Pi, making it ideal for IoT or low-resource environments.

Modern Security First

Defaults to secure settings like ed25519 token signing and S256 PKCE, with strong emphasis on FIDO2/WebAuthn passkeys for passwordless authentication, including passkey-only accounts.

Comprehensive Feature Set

Supports OIDC, OAuth 2.0, PAM/NSS integration for Linux auth, high availability, client branding, i18n, and events with alerting, covering from web apps to SSH logins.

Flexible Deployment Options

Offers embedded Hiqlite or Postgres backends, scales to millions of users, and supports HA mode without external dependencies, simplifying operations.

Cons

Ecosystem and Maturity Gaps

As a newer project, it lacks the extensive plugin library and community-driven integrations of established alternatives like Keycloak, which may require custom development for specific needs.

Complex PAM/NSS Setup

Integrating Linux system authentication requires separate modules in a different repo with GPLv3 dependencies, adding setup complexity and potential licensing considerations.

Testing Hurdles with Passkeys

Self-signed TLS certificates—used in local testing—block passkey registration in browsers like Firefox, forcing users to manually trust CAs, which adds overhead for development.

Open Source Alternative To

Rauthy is an open-source alternative to the following products:

Keycloak

Keycloak is an open-source identity and access management solution that provides single sign-on, user federation, and social login capabilities for web applications and services.

Frequently Asked Questions

Related Projects

clash-verge-rev

A modern GUI client based on Tauri, designed to run in Windows, macOS and Linux for tailored proxy experience

Stars133,401

Forks9,643

Last commit18 hours ago

deno

A modern runtime for JavaScript and TypeScript.

Stars107,767

Forks6,196

Last commit23 hours ago

Alacritty

A cross-platform, OpenGL terminal emulator.

Stars65,033

Forks3,524

Last commit10 days ago

Magisk

The Magic Mask for Android

Stars61,865

Forks18,062

Last commit1 month ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub