Unlatch
Unlatch is a single sign-on server you host yourself. It speaks OpenID Connect, so people sign in once and can then use every service you connect to it, such as Grafana, Forgejo or Nextcloud. It is written in Rust with few dependencies and runs as one binary with one SQLite file.
Unlatch is young: it hasn't been audited or certified yet.
Features
- Sign-in with a password and a code from an authenticator app, or with Google, GitHub and other OpenID providers.
- OpenID Connect for applications that support it.
- Forward authentication through nginx, Traefik or Caddy for applications that don't.
- A web interface for applications, users, groups, sessions and sign-in providers.
Getting started
Download a release,
install it with cargo install --locked unlatch, or build it with cargo build --release.
To try it on this machine:
(umask 077; unlatch generate-key > key)
UNLATCH_ISSUER=http://localhost:8080 UNLATCH_KEY_FILE=key unlatch
Then open the link from the log, which creates the first administrator. The administrator then connects applications and invites people in the web interface.
Documentation
- Running Unlatch: releases, systemd, containers, reverse proxy and backups.
- Configuration: every setting.
- Connecting applications: OpenID Connect settings, what applications learn about users, and an example.
- Users and groups: invitations, lost passwords and access by group.
- Sign-in providers: signing in with Google, GitHub and others.
- Forward authentication: protecting services without OpenID Connect.
- Changes
Development
- Architecture: how Unlatch works, why, and what is left out on purpose.
- Threat model: what it protects against and what it doesn't.
- Conformance: results of the OpenID Foundation's test suite.
- Contributing
- Reporting a vulnerability