{"id":51423602,"url":"https://github.com/aslancarlos/machine-identity-explainer","last_synced_at":"2026-07-05T01:03:28.786Z","repository":{"id":359683414,"uuid":"1247092409","full_name":"aslancarlos/machine-identity-explainer","owner":"aslancarlos","description":"Interactive explainer for Machine Identity: SPIFFE/SPIRE, X.509 SVIDs, mTLS, and zero-trust workload identity, with diagrams you can poke at","archived":false,"fork":false,"pushed_at":"2026-06-18T03:59:17.000Z","size":254,"stargazers_count":0,"open_issues_count":6,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T04:09:55.359Z","etag":null,"topics":["machine-identity","mtls","non-human-identity","spiffe","spire","workload-identity","x509","zero-trust"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aslancarlos.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-22T22:29:38.000Z","updated_at":"2026-06-18T03:59:20.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/aslancarlos/machine-identity-explainer","commit_stats":null,"previous_names":["aslancarlos/machine-identity-explainer"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/aslancarlos/machine-identity-explainer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aslancarlos%2Fmachine-identity-explainer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aslancarlos%2Fmachine-identity-explainer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aslancarlos%2Fmachine-identity-explainer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aslancarlos%2Fmachine-identity-explainer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aslancarlos","download_url":"https://codeload.github.com/aslancarlos/machine-identity-explainer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aslancarlos%2Fmachine-identity-explainer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35140195,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["machine-identity","mtls","non-human-identity","spiffe","spire","workload-identity","x509","zero-trust"],"created_at":"2026-07-05T01:03:21.104Z","updated_at":"2026-07-05T01:03:28.336Z","avatar_url":"https://github.com/aslancarlos.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# machine-identity-explainer\n\n[![build](https://github.com/aslancarlos/machine-identity-explainer/actions/workflows/build.yml/badge.svg)](https://github.com/aslancarlos/machine-identity-explainer/actions/workflows/build.yml) [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n\nInteractive single-page application that walks through the core building blocks of **Machine Identity Security**: SPIFFE, SPIRE, X.509 SVIDs, JWT SVIDs, mTLS, and the zero-trust workload identity model that underpins modern cloud-native security. Companion to the [IDIRA Secrets Manager demos](https://demo.minha.cloud).\n\n\u003e **2026-05-27 — rebrand \u0026 theme** · Visual language now follows [paloaltonetworks.com/idira](https://www.paloaltonetworks.com/idira): Onest typography + IBM Plex Mono, IDIRA palette, **dark + light theme** with user toggle in the nav (persists to `localStorage`, falls back to `prefers-color-scheme`). Skip-to-content link, visible focus rings, and `prefers-reduced-motion` support (WCAG 2.4.1 / 2.3.3). See [`src/lib/useTheme.ts`](src/lib/useTheme.ts) and [`src/components/ThemeToggle.tsx`](src/components/ThemeToggle.tsx).\n\nLive at: `https://machine.minha.cloud/`\n\n---\n\n## What this demonstrates\n\nMachine identity is the next decade's identity problem. Every workload, service, CI runner, and AI agent needs to authenticate to other workloads — without long-lived API keys, shared secrets, or human intervention. This explainer covers the foundational patterns:\n\n| Concept | What it shows |\n|---|---|\n| SPIFFE IDs | Universal naming scheme for workloads across clouds, K8s, and VMs |\n| SPIRE Server / Agent | How identity is attested and issued at runtime |\n| X.509 SVIDs | Short-lived certificates as workload credentials |\n| JWT SVIDs | JWT-based alternative for HTTP and message-bus workloads |\n| mTLS | Mutual authentication based on workload identity, not network location |\n| Trust Domains | Federation between organizations and clouds |\n\nEach section is interactive — you can step through attestation flows, inspect certificate contents, and see how a workload moves from \"no identity\" to \"fully attested and authorized\" without ever touching a static secret.\n\n## Why this matters\n\nThe industry has spent two decades hardening human identity (SSO, MFA, conditional access). Machine identity is roughly where human identity was in 2010: long-lived credentials, broad scope, weak rotation, and very little observability. SPIFFE/SPIRE is one of the open foundations for closing that gap, alongside cloud-native primitives like IRSA, Workload Identity Federation, and Conjur `authn-jwt`.\n\n## Live SCEP enrollment\n\nThe `/scep` tool requests a real certificate from any SCEP server (RFC 8894) —\nVenafi, Microsoft NDES, EJBCA, etc. Supply the SCEP URL and challenge password,\nthen enrol as a **machine** (CN = FQDN, DNS SANs) or a **user** (CN = name, email\n/ UPN SANs). The full exchange — `GetCACaps`, `GetCACert`, RSA keygen, PKCS#10\nCSR, the signed/enveloped `PKCSReq` pkiMessage, `PKIOperation`, and decrypt of the\nissued cert — runs server-side in `api/scep.cjs` (pure Node.js + `node-forge`).\n\nKeys, CSR, and the challenge are never persisted or logged server-side. The\npublic-facing proxy resolves the target host and refuses private/internal\naddresses (SSRF guard), and verifies the endpoint's TLS by default (an explicit\nper-request opt-in is required to skip it for private/self-signed CAs).\n\n\u003e The API server (`api/server.cjs`) now depends on `node-forge`; run `npm install`\n\u003e wherever it is deployed and restart the `mi-scan-api` service.\n\n## Running locally\n\n```bash\nnpm install\nnpm run dev\n```\n\nThen open `http://localhost:5173`.\n\n## Building / Docker\n\n```bash\nnpm run build\ndocker build -t machine-identity-explainer .\ndocker run -p 8080:8080 machine-identity-explainer\n```\n\n## Tech stack\n\n- **Vite + React + TypeScript** for the SPA\n- **Tailwind CSS** for styling\n- **Nginx** as the production server (in the Docker image)\n\n## Related projects\n\n- [conjur-explainer](https://github.com/aslancarlos/conjur-explainer) — Same explainer pattern, focused on IDIRA Secrets Manager\n- [k8s-eso-shop](https://github.com/aslancarlos/k8s-eso-shop) — End-to-end demo of External Secrets Operator on K8s\n\n## License\n\nApache License 2.0 — see [LICENSE](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faslancarlos%2Fmachine-identity-explainer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faslancarlos%2Fmachine-identity-explainer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faslancarlos%2Fmachine-identity-explainer/lists"}