https://github.com/greenpau/caddy-security
🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐
https://github.com/greenpau/caddy-security
access-control acl auth authentication authorization caddy-plugin caddy2 jwt ldap oauth2 openid paseto paseto-tokens saml secdevops secops security sso webauthn websecurity
Last synced: 18 days ago
JSON representation
🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐
- Host: GitHub
- URL: https://github.com/greenpau/caddy-security
- Owner: greenpau
- License: apache-2.0
- Created: 2022-01-15T17:59:24.000Z (almost 5 years ago)
- Default Branch: main
- Last Pushed: 2026-10-05T16:34:37.000Z (about 1 month ago)
- Last Synced: 2026-10-06T15:57:41.685Z (about 1 month ago)
- Topics: access-control, acl, auth, authentication, authorization, caddy-plugin, caddy2, jwt, ldap, oauth2, openid, paseto, paseto-tokens, saml, secdevops, secops, security, sso, webauthn, websecurity
- Language: Go
- Homepage: https://authcrunch.com/
- Size: 2.56 MB
- Stars: 2,249
- Watchers: 15
- Forks: 105
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Security: SECURITY.md
- Agents: AGENTS.md
Awesome Lists containing this project
- awesome-starred - greenpau/caddy-security - 🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML A (security)
- awesome-openid-connect - caddy-security - OpenID Connect Relying Party authentication plugin for the Caddy web server. (Relying Parties (RP) Software Plugins / Rust)
- awesome-ccamel - greenpau/caddy-security - 🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐 (Go)
README
# caddy-security
Security App with Authentication and Authorization Plugins
for [Caddy v2](https://github.com/caddyserver/caddy).
It includes:
* Authentication Plugin for implementing Form-Based, Basic, Local, LDAP, OpenID
Connect, OAuth 2.0, SAML Authentication
* Authorization Plugin for HTTP request authorization based on JWT/PASETO tokens
* Credentials Plugin for managing credentials for various integrations
To retain sessions and generated signing keys across restarts, enable
[persistent runtime state](.codex/skills/configuration-state/references/operations.md).
It supports portals and direct OAuth policies without a portal. Persistent
deployments require a complete stop/start; overlapping reload is rejected.
Please show your **appreciation for this work** and :star: :star: :star:
Please consider **sponsoring this project** via Github Sponsors!
Please ask questions either here or via LinkedIn. I am happy to help you! @greenpau
Documentation for this project was previously hosted at
https://docs.authcrunch.com. As AI agents become part of the development
workflow, this repository is moving to skill-based documentation that helps both
humans and AI agents work with the codebase.
See [Runtime ownership and reload behavior](.codex/skills/coding-directives/references/runtime-lifecycle.md)
for request draining, failed replacement cleanup, and the restriction on
overlapping runtimes that use the same local identity file.
For standalone command-line portal login with named profiles, see
[`caddy-authenticator`](cmd/caddy-authenticator/README.md) for release downloads,
Go installation and usage. Its release archives support Linux, macOS and Windows
on amd64 and arm64.
Run `bin/authcrunch security version` to display the linked go-authcrunch version.
See [version diagnostics](.codex/skills/scripts-and-automation/SKILL.md#security-dependency-version)
for module replacement details.
Download Caddy with the plugins enabled:
* windows/amd64
* linux/amd64
## Tests and Reports
Run `make dep` to download module dependencies and resolve the pinned `tested`
tool, then `make test` for race-enabled Go tests and coverage. Open
`.coverage/index.html` for the report dashboard. `make run-reports` rebuilds
reports from recorded evidence without rerunning tests.
Test and report workflows require Python 3.9+ and macOS or Linux. They stream
progress and monitor resource usage, with one guarded run per checkout. See
[test resource controls](.codex/skills/scripts-and-automation/references/test-resources.md)
for limits, overrides and interruption evidence.
`make ci-check` runs version checks, automation fixtures, the full Go suite,
and the Caddy binary build. GitHub Actions uploads the complete report bundle
with a versioned name, including failure evidence, and retains it for 14 days.
Release publication requires the same CI gate.
See [Testing and CI](.codex/skills/testing-and-ci/SKILL.md) for focused runs and
report files, and [Release and Versioning](.codex/skills/release-and-versioning/SKILL.md)
for artifact names and release procedures.