Skip to content

Releases: Gatewayauth/Gateway

Release list

v1.0.0

v1.0.0 Latest
Latest

Choose a tag to compare

View all tags
@DerSimeon DerSimeon released this 29 Aug 22:20
v1.0.0
f4bb933
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Gateway v1.0.0

First stable release of Gateway, a self-hosted OpenID Connect / OAuth2 identity
provider and authentication backend. A simpler, open-source alternative to
Keycloak for running your own SSO.

This is the backend (JSON API + OIDC endpoints), written in Kotlin on Ktor. The
user interface ships separately as Keychain.

Highlights

  • Local accounts: registration, Argon2id password hashing, and server-side sessions.
  • External login: Google, GitHub, and Discord via OAuth2 + PKCE, with takeover-safe
    account linking.
  • Multi-factor auth: TOTP enrollment with encrypted secrets and one-time recovery codes.
  • OIDC provider: authorization-code flow with PKCE, RS256 ID and access tokens,
    refresh-token rotation with reuse detection, plus discovery and JWKS endpoints.
  • Rotatable signing keys: persisted and encrypted at rest, rotated on demand or on a
    schedule. Retired keys remain in JWKS so previously issued tokens still verify.
  • Email flows: address verification and password reset over SMTP, with a log-only
    mailer for development.
  • Admin API: manage OAuth clients, users, sessions, signing keys, and the audit log.
  • Audit log: append-only record of security events.
  • Multi-tenancy and role-based access control, with per-client required roles.
  • API documentation via Swagger UI at /swagger.

Storage and operations

  • Postgres or H2, using Exposed with Flyway migrations.
  • Built-in CORS and per-IP rate limiting on authentication endpoints.
  • Container images published to GHCR at ghcr.io/gatewayauth/gateway. Pin your
    deployment to 1.0.0 rather than latest.

Security

  • Dependencies pinned and patched: all known transitive CVEs (jackson, netty,
    httpcomponents, log4j, commons-compress, plexus-utils) resolved via build
    constraints.
  • CI security scanning on every push and pull request: CodeQL, Semgrep, Trivy, and
    OpenSSF Scorecard, with SHA-pinned actions and digest-pinned base images.
  • Runtime hardening: non-root container, HTTP security headers, and AES-GCM secret
    encryption with a fresh per-message nonce.
  • Vulnerability reporting: see SECURITY.md (private GitHub Security Advisories).

Vulnerabilities fixed in this release

None. This is the initial public release.

Requirements

JDK 21, Postgres (or H2 for local runs), and Redis. See the README and
docs/IMPLEMENTATION.md for setup.

Assets 2
Loading