A lightweight, secure, and efficient open-source Identity Provider supporting OpenID Connect, OAuth 2.0, and PAM authentication.
Rauthy is a lightweight, resource-efficient single sign-on (SSO) identity and access management solution built in Rust. It provides a secure OpenID Connect and OAuth 2.0 provider with modern authentication features like passkey-only accounts, designed to be simple to deploy and operate from low-resource hardware like Raspberry Pi to large-scale deployments.
Developers and system administrators needing a lightweight, secure identity provider for web applications, IoT projects, or centralized Linux/SSH authentication without the overhead of traditional solutions like Keycloak.
Developers choose Rauthy for its low memory footprint (often under 100MB), secure defaults like ed25519 token signing, built-in high availability, and unique features such as custom PAM/NSS modules for Linux system authentication and passkey-only accounts without consuming device storage slots.
Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Built in Rust for minimal footprint, often under 100MB RAM, and can run fully on a Raspberry Pi, making it ideal for IoT or low-resource environments.
Defaults to secure settings like ed25519 token signing and S256 PKCE, with strong emphasis on FIDO2/WebAuthn passkeys for passwordless authentication, including passkey-only accounts.
Supports OIDC, OAuth 2.0, PAM/NSS integration for Linux auth, high availability, client branding, i18n, and events with alerting, covering from web apps to SSH logins.
Offers embedded Hiqlite or Postgres backends, scales to millions of users, and supports HA mode without external dependencies, simplifying operations.
As a newer project, it lacks the extensive plugin library and community-driven integrations of established alternatives like Keycloak, which may require custom development for specific needs.
Integrating Linux system authentication requires separate modules in a different repo with GPLv3 dependencies, adding setup complexity and potential licensing considerations.
Self-signed TLS certificates—used in local testing—block passkey registration in browsers like Firefox, forcing users to manually trust CAs, which adds overhead for development.
Rauthy is an open-source alternative to the following products: