The release of Issuerd 0.1.17 is now available — an Identity and Access Management (IAM) server that implements OpenID Connect and OAuth 2.x protocols, compatible with the Keycloak platform at the data model level and managing a REST API. Features include SSO, MFA (TOTP, WebAuthn/passkeys), user federation from LDAP and Kerberos/SPNEGO, login through external identity providers (OIDC, social networks), customizable login pages with localization, and a declarative initial configuration from YAML at first launch. The server is written in Rust (unsafe code is prohibited at the attribute level), distributed under the Apache 2.0 license, and provided as a single self-contained binary file that includes an admin console and a user console. Builds are available for Linux, Windows, and macOS (amd64 and
arm64).
A key feature of the project is continuous compliance testing
against the official OpenID Foundation Conformance Suite (5.3.2). Testing is conducted in CI for each release in an isolated Docker environment. Modular results are stored in the repository, and a complete report package is attached to
each release. Parity with Keycloak is maintained through a test suite. Plans include obtaining official certification.
Among the protocols demanded in AI-agent scenarios, DPoP (RFC 9449, binding token to presentation key), token exchange (RFC 8693, narrowing permissions during token exchange), and CIBA (poll mode, human action confirmation) have been implemented. Also supported are PAR (RFC 9126), JAR (RFC 9101), JARM, RAR (RFC 9396), dynamic client registration (RFC 7591/7592), and device authorization (RFC 8628). Importing 100,000 users from MS Active Directory takes about 30 seconds.
Source: opennet.ru
