The release of Issuerd 0.1.17 has been published – an identity and access management (IAM) server that implements the OpenID Connect and OAuth 2.x protocols and is compatible with the Keycloak platform at the data model and manager level REST API. Implemented SSO, MFA (TOTP, WebAuthn/passkeys), federation of users from LDAP and Kerberos/SPNEGO, login through external identity providers (OIDC, social networks), login pages with custom design and localization, declarative initial configuration from YAML at first launch. The server is written in Rust (unsafe code is prohibited at the attribute level), distributed under the Apache 2.0 license and is supplied as one self-contained binary file, which includes an administrative console and a user console. Assemblies are generated for Linux, Windows and macOS platforms (amd64 and
arm64).
The key feature of the project is continuous compliance checking
the official OpenID Foundation Conformance Suite (5.3.2) tests. Testing is carried out in CI for each release in an isolated Docker environment. Modular results are stored in repository, and the full package of reports is attached to
every release. Parity with Keycloak is monitored by a set of tests. There are plans to undergo official certification.
The protocols that are in demand in scenarios with AI agents include DPoP (RFC 9449, binding a token to the bearer key), token exchange (RFC 8693, narrowing of powers when exchanging a token) and CIBA (poll mode, confirmation of human actions). Also supported are PAR (RFC 9126), JAR (RFC 9101), JARM, RAR (RFC 9396), dynamic client registration (RFC 7591/7592), device authorization (RFC 8628). Complete import of 100 thousand users from MS Active Directory takes about 30 seconds.