Boruta server - a lightweight Identity and Access Management solution

Your Libraries & OS Mentoring Libraries
, , ,
1

Still an ongoing work but yet OpenID certified I have been writing a standalone version on top of boruta | Hex that includes:

  • an OAuth 2.0/OpenID Connect certified authorization server
  • an identity provider with configurable backends
  • an administration interface
  • a light gateway that enables authorization

The source code is available at GitHub - malach-it/boruta-server: Lightweight Identity and Access Management solution

I am looking for production use cases to integrate this first beta release. If you have any need for an identity and access management solution, drop me a note to discuss the needs for such an integration.

The documentation is still a work in progress, do not hesitate to reach out if you have questions about how it does work or what is possible to do with the server.

All kinds of feedback will be very welcome!

Thank you for reading me so far, hope to see you around.

15 Likes
2

Hi @pknoth this sounds great. As you know I’ve already started integrating the boruta lib into Bonfire: GitHub - bonfire-networks/bonfire_open_id: Use OpenID and OAuth with your Bonfire identity or connect to Bonfire with an external identity and may want to also integrate these tools, in which case would it be possible to package the apps as libraries rather than a standalone umbrella project? (maybe keeping boruta-server as an example repo that wraps those libraries)

3

Hi @mayel,

I built a standalone version of boruta in order to open its usage beyond the Elixir community and enable any service to get the advantages of such a solution. I designed it to be evolutive to handle further needs and features, thinking of all the possible improvements in the authentication field, but also to have a wider implementation of OAuth/OpenID specifications.

That said, I think the idea to extract some of it to support the elixir package can be a good idea, I’ll keep that in mind knowing that it would bring more work and maintenance to be in a good shape.

2 Likes
4

I might be interested, will be in the market for an OAuth server soon. A question though, is there a reason why the main boruta project is on gitlab and this one on GitHub? Makes it a little difficult to browse

3 Likes
5

Hi again,

Few months ago, I recorded a loom presentation about the installation of the server. Here it is, with the hope it will help better understand how it works. Loom | Free Screen & Video Recording Software | Loom

Cheers

4 Likes
6

Then I started to post on LinkedIn about boruta, publishing a video series about how the server works :heart:

The installation - linkedIn
Client management - linkedIn

More are to come.

Like it, share it, the more it is visible the best it is!

Thank you reading me

3 Likes
7

I’ve just started using Boruta to build a connection to Keycloak - it works very nicely. I will be sharing your Linkedin Posts :slight_smile:

8

Hi there!

These days, I am working on a code of conduct for all boruta related projects. It would be a derivate of contributor covenant and would like to publish the result with the same license (CC 4.0).

If any would like to participate to the working group, do not hesitate to reach out.

Have a nice day/afternoon/evening wherever you are.

9

Hey !

A little note about a new video of the boruta series. It is short and talks about managing users with the server. Here it is on linkedin.

Thank you for listening if you had.

Have a great morning/afternoon/evening wherever you are!

2 Likes
10

Hi there!

I have recently been implementing micro gateways into the boruta server. Here is a new video of the boruta series demonstrating them on Linkedin

The code source of the server is still available on GitHub

As always, all feedback is very welcome :slight_smile:

Cheers

1 Like
11

I am glad to say that this server is now also certified for the Config and Dynamic OP by the OpenID Foundation.

I released then version 0.2.0 with quite a lot of improvements:

  • [gateway] introspected token forwarding to updatreams
  • [identity] email templates edition
  • [identity] configure, expose and edit user metadata
  • [identity] user metadata configuration
  • [gateway] static configuration
  • [gateway] microgateways
  • [identity] identity federation (login with button)
  • [auth] better well-known openid configuration
  • [auth] dynamic client registration
  • [auth] client authentication methods configuration
  • [auth] global signing key pairs

As a reminder,

I also plan to launch a documentation website to better understand how the server works, stay tuned.

With care,

4 Likes
12

I just finished recording the series of demo videos of boruta:

Have a look, all feedback is welcome!

Thank you for listening to me (if you have).

Cheers

4 Likes
13

I just published the story of the product in medium - https://medium.com/p/f3b9ca5a9ac9

Departing from scratch, I tell how I came to create a full Identity and Access Management solution.

Happy reading!

2 Likes
14

If you want to support, the product needs you!

As I am looking for funds to hire a technical writer to redact the documentation, the project is open for donations on open collective - boruta server - Open Collective

Thank you for your support.

Cheers

3 Likes
15

boruta server is now available on DockerHub

https://hub.docker.com/r/malachit/boruta-server

Happy coding!

2 Likes
16

Hi there,

Lastly, I integrated TOTP as a second factor for second-factor authentication. It helps to make use of an authenticator to secure your account.

Here is a video demonstrating the behavior - Pascal Knoth on LinkedIn: TOTP Authentication Demo: Enabling Time-Based One-Time Passwords 👍

Have a great day/afternoon/night wherever you are

1 Like
17

We have been using this in conjunction with Keycloak orchestration (we set up new singon environments from elixir) and this is working very nicely. Awesome work!

2 Likes
18

Hi all,

I recently worked to enable self-sovereign identity by implementing the specifications from the IETF, W3C, and OpenID Foundation. Then I have a working Proof of Concept of verifiable credential issuance which is great !

I wrote an article about what is SSI and what I do within that frame - https://medium.com/p/479f2ffa5f4e

As usual, all feedback is very welcome :slight_smile:

19

The version 0.4.0 is out.

This release contains (as stated in the changelog):

  • [ssi] Configurable verifiable credentials issuance with oid4vci implementation
  • [ssi] Siopv2 same device implementation
  • [auth] Demonstration proof of possession implementation
  • [auth] Pushed Authorization Request implementation
  • [infra] Server ip address bindings configuration via environment variables
  • [infra]Infrastructure as Code with static file configuration
  • [admin] Admin ui improvements
  • [auth] Better identity federation
  • [identity] Webauthn integration
  • [infra] Remote IP logging

This brings boruta to the new era of the Self-Sovereign Identity with certified verifiable credentials issuance abilities. Cannot wait the implementation of verification with oid4vp!

Have a great morning/evening/afternoon wherever you are.

2 Likes