Identity · OpenID Provider · Free to install

Sign-in without the dread.

A self-hosted, multi-tenant, passkey-first identity server. One static binary and a Postgres database. The people who sign in touch their device and they are in, with no password to forget and no one else holding the keys.

Install ids Releases

Welcome back

Use your passkey to continue.

Your tenant · your brand · your server

What your users feel. What you keep.

RELIEF

No passwords to lose

Passkeys first, with multi-factor and consent screens when you want them. Sign-in becomes the easiest part of your product.

CONTROL

Everyone's own corner

Multi-tenant from the first migration. Each tenant gets its own branding, managed from an admin console or through the management API.

REACH

Meet people where they are

Federate with upstream OpenID providers, Google and GitHub, or let people sign in with a Web3 wallet.

Boring where it matters.

Identity is the one place you want no surprises. So the choices are written down, and the dependencies are few.

One static Go binary, Postgres only, also packaged as a .deb you can install

Standard library first; every third-party dependency needs a written decision

A written threat model and architecture decision records for the reasoning

Signing keys rotate on a schedule; the process refuses to start on bad configuration

Already signs people in to the other apps in this lab

Everything sign-in needs, in one place.

Nothing here is an add-on. It is all in the one binary you install.

Passkeys first

Passkeys and hardware security keys

Authenticator-app codes with one-time recovery codes

E-mail one-time code, and trusted devices

Password rules with a leaked-password check

PROTECT

Quietly defensive

Bot and credential-stuffing defence

Extra step-up for a new browser or country

Sign-in alerts to the person, and a security posture page

Signing keys rotate on a schedule

CONNECT

Speaks to your apps

OpenID Connect and OAuth 2.1 with PKCE

SAML for older applications

SCIM provisioning, and a read-only LDAP view over LDAPS

Sign-in through Google, GitHub or any upstream OpenID provider

Device flow for TVs and command-line tools

RUN A TEAM

People and roles

Groups with group managers

Admin roles: Owner, Security admin, User admin, Auditor

Invite by e-mail, or import a list

Roles, custom attributes and claim rules

Organizations inside a tenant, each with its own admin

SEE

A record you can trust

Audit log with signed checkpoints, and export

Webhooks and log forwarding

Metrics for your own dashboards

MAKE IT YOURS

Your brand, your domain

Logo, colours and e-mail templates per tenant

Your own domain for each tenant

A per-person account page: devices, sessions, profile

Sealed backups with restore drills

Bring it home.

Linux, amd64. The installer picks Docker if it finds it, or you can choose.

Install

$ curl -fsSL https://raw.githubusercontent.com/ulab24/ids/main/install.sh | bash

Or choose the mode

$ curl -fsSL https://raw.githubusercontent.com/ulab24/ids/main/install.sh | bash -s -- --mode=systemd

$ curl -fsSL https://raw.githubusercontent.com/ulab24/ids/main/install.sh | bash -s -- --mode=docker

Then, with systemd

$ vim /etc/ids/ids.env # set IDS_DATABASE_URL and IDS_KEK

$ systemctl enable --now ids

Or, with Docker

$ vim /opt/ids/.env # set IDS_DATABASE_URL and IDS_KEK

$ cd /opt/ids && docker compose up -d

ids needs a Postgres database. Checksums are verified on every download, and signatures too when GPG is available.

From install to first sign-in.

About ten minutes, once ids is installed (see above) and Postgres is reachable. Commands below use the systemd install; with Docker the file is /opt/ids/.env instead.

STEP 1 · Create a database

ids needs an empty Postgres database and a user that owns it.

$ sudo -u postgres createuser --pwprompt ids

$ sudo -u postgres createdb -O ids ids

STEP 2 · Set the three required values

Open the environment file and fill in the database address and a secret key. Back the key up somewhere other than this server; without it the stored secrets cannot be read.

$ openssl rand -base64 32 # paste the result as IDS_KEK

$ vim /etc/ids/ids.env # IDS_DATABASE_URL, IDS_LISTEN_ADDR, IDS_KEK

STEP 3 · Create the tables

One command prepares the database. Running it again is harmless.

$ set -a; . /etc/ids/ids.env; set +a; ids migrate

STEP 4 · Put it behind your web address

Point a name such as id.example.com at the server and put your usual reverse proxy with HTTPS in front. Tell ids which proxy to trust.

$ IDS_EXTERNAL_SCHEME=https

$ IDS_TRUSTED_PROXY_CIDRS=10.0.0.0/8 # your proxy's network only

STEP 5 · Create the first administrator

Set these once, start ids, and open the address. When the first admin exists you can remove them.

$ IDS_BOOTSTRAP_TENANT_HOSTNAME=id.example.com

$ IDS_BOOTSTRAP_ADMIN_EMAIL=you@example.com

$ IDS_BOOTSTRAP_ADMIN_TOKEN=a-long-random-string

$ systemctl restart ids

STEP 6 · Register a passkey

Open your address, continue as the administrator, and add a passkey. From then on you sign in with a touch. The admin console lives at /admin/.

STEP 7 · Turn on e-mail (optional)

To send invitations and verification codes, give ids any mail service on port 587.

$ IDS_SMTP_HOST=smtp.example.com

$ IDS_SMTP_PORT=587

$ IDS_SMTP_FROM=id@example.com

Connect an app.

The admin console has a quickstart for each of these. Pick one, copy the values, and paste them into the app.

Forgejo and Gitea

Grafana

Portainer

NetBird

Nextcloud

Anything that speaks OpenID Connect, SAML or LDAP

Good questions.

Is it really free?

Yes. You install it and run it on your own server, with no account with us and no sign-up.

Where does my data live?

In your Postgres database, on your server. Nothing is stored with us.

Can I read the source?

The source is not published. The installer and releases are on GitHub, and the design notes are written up on this site.

What do I need to run it?

A Linux server (amd64), a Postgres database, and a web address with HTTPS in front.

Can many companies share one install?

Yes. Each tenant has its own address, branding, people and admin console.

How do I update it?

Install the new release, run ids migrate again, then restart the service. Migrations are safe to re-run.

I am stuck.

Write to me. I read every message.

Need it to speak to a system you already run? Let's make it fit.

Talk to me or write to me privately

Keep exploring

ulx → whiteboard → writing →