Authentication Provider API

The Context

Consolidating Identity & Access Management

TypeOpen Source Micro-Service

LicenseAGPL-3.0

DatabasePostgreSQL + Drizzle ORM

Session StorageRedis backed whitelist/sessions

A complete, self-hostable authentication service built from scratch to replace the costly, off-the-shelf auth providers. It was designed for custom multi-service integration, session revokability, and total data ownership, keeping user data out of proprietary auth providers. It uses JWT tokens to manage stateless access across your environments services, while having a refresh token whitelist, allowing for easy revocation and session management.

Tech & Features

Complex Problems, a Simple Solution

Tech Stack

TypeScriptNode.jsExpress.jsDrizzle ORMRedisPostgreSQL

Multi-Tenant & Service Scoped

Permissions are namespaced per service (e.g., auth:user.read, keys:key.read), enabling a single auth instance to gate downstream micro-services effortlessly.

Device-Aware Session Control

Granular session whitelisting tracks IP, browser, and OS metadata per device ID, allowing target revocations or universal logouts across all active contexts.

100%Self-Hosted & Data Ownership

Deep Dive

Deep Dive: The Architecture of Auth

Authentication is a core capability every system requires, but existing SaaS solutions quickly introduce vendor lock-in, unfavorable per-user scaling costs, and opaque user data boundaries. The primary goal of this microservice was to architect an independent, zero-dependency authentication engine designed for self-hosted deployments.

When a user logs in, the service issues a JWT access and refresh token pair. External microservices validate the access token statelessly using a shared secret. However, session state is concurrently maintained in Redis through a active session whitelist mapped to an HTTP-only cookie (_selected_s) and a persistent device identifier (_d_identifier). This dual layer guarantees immediate session revokability without requiring database lookups on every route invocation.

Operational Hardening

Security precautions extend throughout the entire request lifecycle. Rate limiters backed by Redis enforce brute-force protection across authentication endpoints. CSRF protection gates mutating state operations, while TOTP credentials undergo server-side AES-256-GCM encryption before hitting the database. System roles (seeded via startup transactions) are protected with immutability flags to safeguard core infrastructure access.

Implementation

AES-256-GCM Encryption

Symmetric encryption routine used to secure tokens like the TOTP secrets before persisting them to PostgreSQL. This provides hightened security if the database were to ever be breached, keeping user accounts secure, even after a security incident occurs.

src/utils/encryption.utils.tstypescript

export function encrypt(text: string) {
  const iv = crypto.randomBytes(12);
  const key = crypto.scryptSync(encryptKey, 'salt', 32);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);

  const encrypted = Buffer.concat([
    cipher.update(text, 'utf-8'),
    cipher.final(),
  ]);
  
  return {
    iv,
    content: encrypted,
    authTag: cipher.getAuthTag(),
  };
}

Visuals

Built-In Management

Fig 01

Service Management

Full control over services in your environment, and what permissions they require for the different routes.

Fig 02

User Visibility

Force users to change their password, add them to more roles, or delete their account.

Taylabs Dashbaord with Roles and Permission management

Fig 03

Roles & Permissions Dashboard

Manage the Roles and permissions that are a part of your environment

Fig 04

API Key management

Create and revoke API keys for different services in your environment. These keys are hashed at rest for the best security, allowing for secure service to service communication.