Pre-1.0

What's built. What's next.

No dates. Each planned item is an open issue; finished work is listed without its number.

Kubernetes operator

Built, not releasedEpic #377

Clients declared beside your apps, registered with the server and their secrets delivered into Secrets. Branding comes next.

In the code today

Registers each OIDCClient with the server over mutual TLS
Writes the minted secret into a Secret the workload mounts
A deletion policy per manifest: retain the client, or delete it
Notices a client changed outside the operator
Refuses a server whose control-plane contract it does not understand
Metrics, leader election and a readiness probe that checks the server
Installed by the server's Helm chart, behind strict network policies
Server side: idempotent, etag-guarded upserts, hashed secrets, and clients owned by the identity that wrote them

Planned

#404Declare sign-in branding from a manifest
#388Test install and upgrade on a fresh cluster
#389Drive the operator against a real server end to end
#443Reload the control-plane certificate without a restart

Later

#378Safe with more than one operator
#379Configure a central server from downstream clusters
#380Let security constrain what developers register
#286Audit the operator control plane

oidcclient.yaml

apiVersion: nauthera.io/v1alpha1
kind: OIDCClient
metadata:
  name: example-webapp
  namespace: storefront
spec:
  clientId: example-webapp
  issuer: https://auth.example.com
  redirectUris:
    - https://app.example.com/callback
  grantTypes:
    - authorization_code
    - refresh_token
  tokenEndpointAuthMethod: client_secret_basic
  pkcePolicy: required_s256
  allowRefresh: true
  secret:
    generate: true

Reconciled by the operator in the code today; no published release yet (#307).

The operator in the docs

Admin dashboard

In developmentInitiative #502

An organization's administrators sign in to see its clients, users, sessions, audit log and email settings, and to end sessions. Managing users and roles comes next.

Sign in at the organization's own branded entry
Read its clients, audit log, insights and alerts over one time range
Manage its users: the only thing the dashboard writes
Switch to another organization without signing in again
Show a developer only the applications they are granted
English, German and French, on any screen size

Epics behind it

#503Admin API access
#504Roles and platform administration
#505Account status and user actions
#506Session history and control
#507Clients and audit data
#508Insights and alerts
#509TypeScript from the API contract
#623Per-application access

The dashboard in the docs

1
Groundwork
Admin-only tokens, a permission for every operation, and a contract and workspace to build on.
Done
- A design record for the dashboard
- A permission for every admin operation, declared in the API contract
- A user's roles read from the database on every admin request, not from the token
- Admin tokens accepted only from an organization's own admin clients
- The session and client recorded on every audit event that has them
- Typed filters and problem codes in the contract, emitted as TypeScript
- The dashboard app, in a web workspace with shared packages
2
Milestone 1 · Walking skeleton
Sign-in, the shell and the audit log.
Done
- Sign-in with proof-bound tokens held only in memory
- A responsive shell with side navigation
- The audit log with the contract's filters, a detail view and a volume chart
Open
- #562Browse the whole range as one virtualized log
- #580Show new audit events as they arrive
3
Milestone 2 · Read-only dashboard
Clients, insights and alerts, brought together on an overview.
Done
- The clients table, with search, filters and sorting
- A client page: configuration, users over time, setup guide and manifest
- One shared time range with auto-refresh
- Troubleshoot a failed request by its request id
Open
- #577Chart sign-in and security activity on the overview
- #576Show what needs attention
4
Milestone 3 · User management
The dashboard's only write surface. Deleting a user stays in the API.
Done
- The users table, with search, filters and sorting
- A user page: profile, sign-in calendar and known devices
- Show and end a user's active and past sessions
Open
- #594Create a user
- #595Edit a user's basic attributes
- #598Suspend, block, reactivate and unlock a user
- #599Manage a user's second factors and password
- #600Grant and revoke dashboard roles
5
Per-application access
Developers see only the applications an owner grants them, read-only.
- #626Admit a developer only to the applications they were granted
- #629Grant and revoke a user's access to specific applications
- #633Show a developer their applications' configuration, activity and events
6
Closing out
Platform alerts, refresh tokens and a guide for operators.
- #555Switch organizations without signing in again
- #603Show the deployment's startup warnings as platform alerts
- #602Proof-bound refresh tokens, capped by the sign-in session
- #605Document how to grant dashboard access and brand it

Built and tested

The identity server, its operator and dashboard, in the code today; not yet in a published release.

Core OAuth 2.0 and OpenID Connect flows
Device authorization grant, approved in the hosted UI
Pushed authorization requests and signed request objects
Dynamic client registration with an initial access token
Organizations as separate issuers with their own keys
Hosted sign-in in three languages, branded per client
TOTP MFA with recovery codes and lockout
Password reset and address verification by email
Per-organization SMTP relays, sent through a durable outbox
New-sign-in alerts by email, with optional IP geolocation
DPoP-bound tokens with nonces and replay checks
RP-initiated, front-channel and back-channel logout
Admin REST API for organizations, users, clients, sessions and the audit log
Admin dashboard for clients, users, sessions, the audit log and email
Kubernetes operator for OIDCClient manifests
Audit log with a closed event catalog, retention and signed checkpoints
Audit forwarding to pluggable exporters
Prometheus metrics, OpenTelemetry traces, structured logs
Startup checks that refuse unsafe production settings
Client-address modes with reverse-proxy detection
PostgreSQL or SQLite, with embedded migrations
Redis standalone, Sentinel or Cluster for shared state
FIPS 140-3 policy mode for builds on Go's FIPS module
Helm chart with cert-manager and opt-in alert rules, installable on kind

Also planned

Other open work, grouped by workstream.

Passkeys

#200Passkey registration and sign-in
#203Passkeys in the hosted sign-in screens
#202Passkey lifecycle, recovery and policy

Multi-factor authentication

#249Challenge every enrolled second factor at sign-in
#250A name, last-used time and revocation per factor

Email-first sign-in

#607Let an organization claim and verify its email domains
#609Enter an email address, continue at the organization that owns it
#610Issuer discovery (WebFinger) for verified domains

Closing spec gaps

#35FAPI 2.0 mode that refuses shared secrets and unbound tokens
#42Hold a client to the signed requests it registered for
#91Retire access tokens on revocation

Credential guessing

#293Answer alike for registered and unknown identifiers
#824Spend the same work on a wrong recovery code, however many remain

Keys and secrets

#300Rotate an organization's signing key without a restart
#351Rotate a client secret without re-creating the client

Secret custody

#336Every mounted secret arrives intact, or the server stops
#337Source every mounted secret from OpenBao, without the server knowing
#338Hold the key-encryption keys in OpenBao, off the cluster

Organizations, accounts and consent

#283Organization and account deletion that takes effect everywhere
#321Consent grants with a lifetime and a way to withdraw

Running at scale

#285Multi-instance state, durability and background sweeps
#298Shared rate limiting when a cache is configured
#926Export the audit log to Kafka

Email and sign-up

#1118Let an organization require a verified address before sign-in
#1120Verify an address and ask for a fresh link in the sign-in app
#1122Keep bots off self-service registration

Browser origins

#962Let each client allow the browser origins its app calls from
#965Note which origin each browser call came from
#953Record which redirect URIs each client tried

Admin console hardening

#951Require a second factor for every admin console sign-in
#950Authenticate the admin machine client with a key, never a secret
#527Rate-limit the admin API per administrator

First release

#307Publish releases so the scanned image is the shipped image

Spec-by-spec status is on the standards page

Hear when the operator ships

Pre-1.0. We'll email you when the operator ships.

By joining, you agree to our Privacy Policy and Terms.

apiVersion: nauthera.io/v1alpha1 kind: OIDCClient metadata: name: example-webapp namespace: storefront spec: clientId: example-webapp issuer: https://auth.example.com redirectUris: - https://app.example.com/callback grantTypes: - authorization_code - refresh_token tokenEndpointAuthMethod: client_secret_basic pkcePolicy: required_s256 allowRefresh: true secret: generate: true

What's built. What's next.

Kubernetes operator

Admin dashboard

Groundwork

Milestone 1 · Walking skeleton

Milestone 2 · Read-only dashboard

Milestone 3 · User management

Per-application access

Closing out

Built and tested

Also planned

Passkeys

Multi-factor authentication

Email-first sign-in

Closing spec gaps

Credential guessing

Keys and secrets

Secret custody

Organizations, accounts and consent

Running at scale

Email and sign-up

Browser origins

Admin console hardening

First release

Hear when the operator ships

What's built. What's next.

Kubernetes operator

Admin dashboard

Groundwork

Milestone 1 · Walking skeleton

Milestone 2 · Read-only dashboard

Milestone 3 · User management

Per-application access

Closing out

Built and tested

Also planned

Passkeys

Multi-factor authentication

Email-first sign-in

Closing spec gaps

Credential guessing

Keys and secrets

Secret custody

Organizations, accounts and consent

Running at scale

Email and sign-up

Browser origins

Admin console hardening

First release

Hear when the operator ships