{"id":14671226,"url":"https://github.com/lastlogin-net/obligator","last_synced_at":"2026-01-24T15:14:19.985Z","repository":{"id":199756701,"uuid":"642424554","full_name":"lastlogin-net/obligator","owner":"lastlogin-net","description":"Simple and opinionated OpenID Connect server designed for self-hosters","archived":false,"fork":false,"pushed_at":"2026-01-20T18:29:58.000Z","size":343,"stargazers_count":825,"open_issues_count":31,"forks_count":23,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-01-21T03:50:16.095Z","etag":null,"topics":["oidc","oidc-server","openid"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lastlogin-net.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-05-18T14:33:51.000Z","updated_at":"2026-01-20T18:30:02.000Z","dependencies_parsed_at":"2023-10-14T13:28:54.087Z","dependency_job_id":"cfaa83da-3f74-4022-a0fd-777ed1974f6d","html_url":"https://github.com/lastlogin-net/obligator","commit_stats":null,"previous_names":["anderspitman/obligator","lastlogin-io/obligator","lastlogin-net/obligator"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/lastlogin-net/obligator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lastlogin-net%2Fobligator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lastlogin-net%2Fobligator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lastlogin-net%2Fobligator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lastlogin-net%2Fobligator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lastlogin-net","download_url":"https://codeload.github.com/lastlogin-net/obligator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lastlogin-net%2Fobligator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28730317,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-24T10:24:43.181Z","status":"ssl_error","status_checked_at":"2026-01-24T10:24:36.112Z","response_time":89,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["oidc","oidc-server","openid"],"created_at":"2024-09-12T04:01:18.962Z","updated_at":"2026-01-24T15:14:19.969Z","avatar_url":"https://github.com/lastlogin-net.png","language":"Go","funding_links":[],"categories":["Go","OAuth2 \u0026 OpenID"],"sub_categories":["Other tools"],"readme":"# Introduction\n\nobligator is a relatively simple and opinionated OpenID Connect (OIDC) Provider\n(OP) server designed for self-hosters.\n\nHacker News discussion [here][13].\n\n\n# Motivation\n\nThere are lots of great open source OIDC servers out there (see\n[comparison](#comparison-is-the-thief-of-joy)). I made obligator because I\nneeded a specific combination of features I didn't find in any of the others.\nHere's a brief list. See the [feature explanation](#feature-explanation)\nsection for more detailed information.\n\n* Simple to deploy and manage. Static executable and either flat-file or sqlite\n  storage\n* Support for anonymous OAuth2 client auth\n* Authenticate to multiple domains at once\n* Passwordless email login\n* Configurable at runtime with an API\n* Support for [forward auth][0] \n* Support for [trusted headers][1]\n* Support for upstream social login providers (GitLab, GitHub, Google, etc)\n\n\n# Design\n\nThe overarching philosophy of obligator is that identities are built on email.\nEmail isn't perfect, but it's the globally unique federated identity we have\nthat works today.\n\nThus the purpose of obligator is to validate that a user controls an email\naddress as simply as possible, and communicate that to the application the\nuser is attempting to log in to. Validation can either be done directly\nthrough SMTP, or delegated to upstream OIDC (and some plain OAuth2) providers.\n\n\n# Running it\n\nYou can initialize obligator with a config file by passing the `-config`\noption with a JSON file matching the following format:\n\n```json\n{\n  \"oauth2_providers\": [\n    {\n      \"id\": \"google\",\n      \"name\": \"Google\",\n      \"uri\": \"https://accounts.google.com\",\n      \"client_id\": \"\u003cgoogle oauth2 client_id\u003e\",\n      \"client_secret\": \"\u003cgoogle oauth2 client_secret\u003e\",\n      \"openid_connect\": true\n    },\n    {\n      \"id\": \"lastlogin\",\n      \"name\": \"LastLogin\",\n      \"uri\": \"https://lastlogin.net\",\n      \"client_id\": \"https://example.com\",\n      \"client_secret\": \"\",\n      \"openid_connect\": true\n    }\n  ],\n  \"smtp\": {\n    \"server\": \"smtp.fastmail.com\",\n    \"username\": \"\u003csmtp-username\u003e\",\n    \"password\": \"\u003csmtp-password\u003e\",\n    \"port\": 587,\n    \"sender\": \"auth@example.com\",\n    \"sender_name\": \"Example\"\n  }\n}\n```\n\nIf you're already using docker, it's the easiest way to get started with\nobligator:\n\n```\nmkdir obligator_docker/\ncp obligator_storage.json obligator_docker/\n\ndocker run --user $(id -u):$(id -g) --rm -it -v $PWD/obligator_docker:/data -v $PWD/obligator_docker:/api -p 1616:1616 anderspitman/obligator:latest -storage-dir /data -api-socket-dir /api -root-uri example.com -port 1616\n```\n\nYou can also download static executables for various platforms from the\n[releases][2] page.\n\n\n# Using the API\n\nCurrently the API is only offered through unix sockets. This reduces the\nchance that it accidentally gets exposed, which is important because\nit's not authenticated in any way.\n\nThere's not any documentation, and the API is in flux, so refer to the\n[source code][3] for usage.\n\nHere's an example assuming you ran the docker command above:\n\n```\ncurl --unix-socket obligator_docker/obligator_api.sock dummy-domain/oauth2-providers\n```\n\nSee [here][4] for more info on using curl over unix sockets.\n\n\n# Support\n\nCommunity support is provided on the [IndieBits forums][11].\n\n\n# Feature explanation\n\n## Anonymous OAuth2 auth\n\nNormally in OAuth2 (and therefore OIDC), an app (client) is required to\npre-register with the provider. This can create a lot of friction, especially\nif you're self-hosting an open source application. App developers are forced to\neither share a single client ID for all their users (and share their\n`client secret`, which essentially makes it pointless), or each user must\nseparately register their instance.\n\nInstead, obligator takes essentially the approach described [here][6]. Any\nOAuth2 client can anonymously authenticate with an obligator instance, with the\n`client_id` equal to the domain of the client, and `client_secret` left blank.\nSecurity is maintained through the following means:\n\n* Only approved email addresses are permitted unless `public: true` is set in\n  the config.\n* The `client_id` URI must be a prefix of the `redirect_uri`, and the\n  `client_id` is displayed to the user when consenting to the login. This\n  guarantees that the user approves the ID token to be sent to the domain\n  shown. Note that this can actually be more secure than pre-registration.\n  There have been attacks in [the past][7] where users were tricked into\n  authorizing apps because the pre-registered information looked convincing. By\n  forcing the user to decide whether they trust the actual domain where the ID\n  token will be sent, and not displaying any sort of logo which can be faked,\n  security is improved.\n\nNote that some servers implement OIDC [Dynamic Client Registration][10], which\nis an official specification to accomplish some of the same goals as anonymous\nauth. When an initial access token is not required (notably the case with Ory),\nthis can result in a very similar experience from the user perspective. The\nmain problem is that client apps must support dynamic client registration, and\nmany don't. Anonymous auth does not require any special features on the client\nside.\n\n## Multi-domain authentication\n\nHave you ever noticed when you login to Gmail on a new computer that you're\nalso automatically logged in to YouTube? How does this work when Gmail is on\ngoogle.com and youtube.com doesn't have any access to the cookies or\nlocalstorage of google.com?\n\nThe [answer][8] is that when you log in on accounts.google.com, it makes a\nquick redirect to youtube.com with a URL parameter to also set up the cookies\nthere. I also want this functionality for all the domains protected by my OIDC\nserver so I'm building it into obligator.\n\n## Passwordless email login\n\nIn line with the philosophy above, email reigns supreme in obligator. Since\npasswords are relatively difficult to use securely, the way to add an email\nidentity is to send a confirmation code to the email address.\n\n\n# Demo\n\nThere's a public instance of obligator running at https://lastlogin.net\n(discovery doc at https://lastlogin.net/.well-known/openid-configuration). You\ncan use it with any OIDC client. Just set the `client_id` to a prefix of the\n`redirect_uri` the client application uses when making the authorization\nrequest. I like to use https://openidconnect.net/ for ad-hoc testing, like so:\n\n1. Click on \"Configuration\" on the right side\n2. Enter the discovery document URL, ie\n   https://lastlogin.net/.well-known/openid-configuration for LastLogin\n3. Click \"Use Discovery Document\". It should populate most of the fields\n4. Set the `client_id` to https://openidconnect.net/. This is a prefix of\n   the `redirect_uri` that openidconnect.net uses, which is\n   https://openidconnect.net/callback\n5. You can leave the `client_secret` as it is or remove it.\n6. Click \"Save\", then \"Start\" to begin the flow.\n\nThe official [OpenID conformance suite][9] is also excellent for testing OIDC\nservers.\n\n\n# Comparison is the thief of joy\n\nSoftware is rarely about right vs wrong, but rather tradeoffs. This table is\nintended to help compare tradeoffs of different servers. It's also very\nincomplete and probably incorrect in many cases. If you have a correction,\nplease submit an issue or leave a comment on the Google sheet [here][5] which\nis where it's generated from.\n\nIt's generated using the excellent https://tabletomarkdown.com\n\n\n|                             | [obligator](https://github.com/lastlogin-net/obligator)                                                                                   | [Portier](https://portier.github.io/)                                                                                                   | [Rauthy](https://sebadob.github.io/rauthy/)                                                                             | [Authelia](https://www.authelia.com/)                                                                                         | [Authentik](https://goauthentik.io/)                                                                                                  | [KeyCloak](https://www.keycloak.org/)                                                                                         | [Vouch](https://github.com/vouch/vouch-proxy)                                                                                 | [oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy)                                                                                  | [Dex](https://dexidp.io/)                                                                                       | [Ory Stack](https://www.ory.sh/hydra/)                                                                        | [Zitadel](https://zitadel.com/)                                                                                           | [Casdoor](https://casdoor.org/)                                                                                           | [Kanidm](https://kanidm.com/)                                                                                         |\n| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |\n| Simple                      | ✅                                                                                                                                         | ✅                                                                                                                                       | ✅                                                                                                                       | ✅                                                                                                                             | ❌                                                                                                                                     | ❌                                                                                                                             | ❓                                                                                                                             | ❓                                                                                                                                             | ❓                                                                                                               | ❌                                                                                                             | ❌                                                                                                                         | ❓                                                                                                                         | ❓                                                                                                                     |\n| Anonymous auth              | ✅                                                                                                                                         | ✅                                                                                                                                       | ✅                                                                                                                       | ❌                                                                                                                             | ❌                                                                                                                                     | ❌                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❌                                                                                                               | ❌                                                                                                             | ❌                                                                                                                         | ❌                                                                                                                         | ❌                                                                                                                     |\n| Multi-domain auth           | ✅ (planned)                                                                                                                               | ❓                                                                                                                                       | ❓                                                                                                                       | ❌                                                                                                                             | ❌                                                                                                                                     | ❌                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❓                                                                                                               | ❌                                                                                                             | ❓                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| Passwordless email login    | ✅                                                                                                                                         | ✅                                                                                                                                       | ❌                                                                                                                       | ❌                                                                                                                             | ❌                                                                                                                                     | ❌                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❌                                                                                                               | ✅                                                                                                             | ❌                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| HTTP API                    | ✅                                                                                                                                         | ❓                                                                                                                                       | ✅                                                                                                                       | ❌                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ✅                                                                                                               | ✅                                                                                                             | ✅                                                                                                                         | ❓                                                                                                                         | ✅                                                                                                                     |\n| Forward auth                | ✅                                                                                                                                         | ❓                                                                                                                                       | ✅                                                                                                                       | ✅                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ✅                                                                                                                             | ✅                                                                                                                                             | ❓                                                                                                               | ✅                                                                                                             | ❓                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| Trusted header auth         | ✅ (planned)                                                                                                                               | ❓                                                                                                                                       | ✅                                                                                                                       | ✅                                                                                                                             | ✅                                                                                                                                     | ❌                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❓                                                                                                               | ✅                                                                                                             | ❓                                                                                                                         | ❓                                                                                                                         | ✅                                                                                                                     |\n| Upstream OIDC/OAuth2        | ✅                                                                                                                                         | ❌ (partial)                                                                                                                             | ✅                                                                                                                       | ❌                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ✅                                                                                                                             | ✅                                                                                                                                             | ✅                                                                                                               | ✅                                                                                                             | ✅                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| SAML                        | ❌                                                                                                                                         | ❌                                                                                                                                       | ❓                                                                                                                       | ❌                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ✅                                                                                                               | Needs coding                                                                                                  | ✅                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| LDAP                        | ❌                                                                                                                                         | ❌                                                                                                                                       | ❓                                                                                                                       | ✅                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ✅                                                                                                               | Needs coding                                                                                                  | ✅                                                                                                                         | ❓                                                                                                                         | ✅                                                                                                                     |\n| MFA                         | ❌                                                                                                                                         | ❓                                                                                                                                       | ✅                                                                                                                       | ✅                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❓                                                                                                               | ✅                                                                                                             | ✅                                                                                                                         | ❓                                                                                                                         | ✅                                                                                                                     |\n| Standalone reverse proxy    | ❌                                                                                                                                         | ❌                                                                                                                                       | ❓                                                                                                                       | ❌                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ❌                                                                                                                             | ✅                                                                                                                                             | ❌                                                                                                               | ✅                                                                                                             | ❓                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| Admin GUI                   | ❌                                                                                                                                         | ❌                                                                                                                                       | ✅                                                                                                                       | ✅                                                                                                                             | ✅                                                                                                                                     | ✅                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❓                                                                                                               | ✅                                                                                                             | ✅                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| Dynamic client registration | ✅                                                                                                                                         | ❌                                                                                                                                       | ✅                                                                                                                       | ❌                                                                                                                             | ❌                                                                                                                                     | ❓                                                                                                                             | ❌                                                                                                                             | ❌                                                                                                                                             | ❌                                                                                                               | ✅                                                                                                             | ❌                                                                                                                         | ❓                                                                                                                         | ❌                                                                                                                     |\n| Passkey support             | ❌                                                                                                                                         | ❓                                                                                                                                       | ✅                                                                                                                       | ❓                                                                                                                             | ❓                                                                                                                                     | ❓                                                                                                                             | ❓                                                                                                                             | ❓                                                                                                                                             | ❓                                                                                                               | ❓                                                                                                             | ❓                                                                                                                         | ❓                                                                                                                         | ✅                                                                                                                     |\n| Vanity                      | [![stars](https://img.shields.io/github/stars/lastlogin-net/obligator?style=flat)](https://github.com/lastlogin-net/obligator/stargazers) | [![stars](https://img.shields.io/github/stars/portier/portier-broker?style=flat)](https://github.com/portier/portier-broker/stargazers) | [![stars](https://img.shields.io/github/stars/sebadob/rauthy?style=flat)](https://github.com/sebadob/rauthy/stargazers) | [![stars](https://img.shields.io/github/stars/authelia/authelia?style=flat)](https://github.com/authelia/authelia/stargazers) | [![stars](https://img.shields.io/github/stars/goauthentik/authentik?style=flat)](https://github.com/goauthentik/authentik/stargazers) | [![stars](https://img.shields.io/github/stars/keycloak/keycloak?style=flat)](https://github.com/keycloak/keycloak/stargazers) | [![stars](https://img.shields.io/github/stars/vouch/vouch-proxy?style=flat)](https://github.com/vouch/vouch-proxy/stargazers) | [![stars](https://img.shields.io/github/stars/oauth2-proxy/oauth2-proxy?style=flat)](https://github.com/oauth2-proxy/oauth2-proxy/stargazers) | [![stars](https://img.shields.io/github/stars/dexidp/dex?style=flat)](https://github.com/dexidp/dex/stargazers) | [![stars](https://img.shields.io/github/stars/ory/hydra?style=flat)](https://github.com/ory/hydra/stargazers) | [![stars](https://img.shields.io/github/stars/zitadel/zitadel?style=flat)](https://github.com/zitadel/zitadel/stargazers) | [![stars](https://img.shields.io/github/stars/casdoor/casdoor?style=flat)](https://github.com/casdoor/casdoor/stargazers) | [![stars](https://img.shields.io/github/stars/kanidm/kanidm?style=flat)](https://github.com/kanidm/kanidm/stargazers) |\n| Language                    | Go                                                                                                                                        | Rust                                                                                                                                    | Rust                                                                                                                    | Go                                                                                                                            | Python                                                                                                                                | Java                                                                                                                          | Go                                                                                                                            | Go                                                                                                                                            | Go                                                                                                              | Go                                                                                                            | Go                                                                                                                        | Go                                                                                                                        | Rust                                                                                                                  |\n| Dependencies                | 5                                                                                                                                         | 21                                                                                                                                      | 73                                                                                                                      | 49                                                                                                                            | 54                                                                                                                                    | ❓                                                                                                                             | 16                                                                                                                            | 36                                                                                                                                            | 36                                                                                                              | 58                                                                                                            | 81                                                                                                                        | 68                                                                                                                        | 116                                                                                                                   |\n| Lines of code               | ~5600                                                                                                                                     | ~9500                                                                                                                                   | ~59000                                                                                                                  | ~148000                                                                                                                       | ~247000                                                                                                                               | ~869000                                                                                                                       | ~5500                                                                                                                         | ~54000                                                                                                                                        | ~63500                                                                                                          | ~330000                                                                                                       | ~603000                                                                                                                   | ~113000                                                                                                                   | ~239000                                                                                                               |\n\n\n\n\n\n\n\nLines of code were calculated using\n[tokei](https://github.com/XAMPPRocky/tokei), and last updated on 2024-04-21.\n\n\nOry is calculated using Hydra + Oathkeeper + Kratos, per [this][12]\n\n[0]: https://doc.traefik.io/traefik/middlewares/http/forwardauth/\n\n[1]: https://www.authelia.com/integration/trusted-header-sso/introduction/\n\n[2]: https://github.com/anderspitman/obligator/releases\n\n[3]: ./api.go\n\n[4]: https://superuser.com/q/834307\n\n[5]: https://docs.google.com/spreadsheets/d/16Ya5KsmEpczTmoTk5J-1e2MOyuUqXIiPuj7rPfPrHAI/edit?usp=sharing\n\n[6]: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web\n\n[7]: https://duo.com/blog/gmail-oauth-phishing-goes-viral\n\n[8]: https://stackoverflow.com/a/19929304/943814\n\n[9]: https://www.certification.openid.net/login.html\n\n[10]: https://openid.net/specs/openid-connect-registration-1_0.html\n\n[11]: https://forum.indiebits.io/c/obligator/11\n\n[12]: https://github.com/lastlogin-net/obligator/pull/2\n\n[13]: https://news.ycombinator.com/item?id=37848793\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flastlogin-net%2Fobligator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flastlogin-net%2Fobligator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flastlogin-net%2Fobligator/lists"}