IDP Deep Dive
This section documents the Identity Provider (IDP) that issues JWT access tokens and supports login, refresh, MFA, OAuth, and password reset. It integrates with Access Control for persistence and authorization.
Overview
The IDP handles:
- Authentication: Email/password, OAuth (Google/Facebook), passkeys/WebAuthn
- Token Management: JWT access tokens, refresh tokens, session management
- MFA: TOTP-based multi-factor authentication
- Account Lifecycle: Registration, password reset, account deletion/restore
Architecture
Contents
Core Documentation
- Endpoints — API endpoints for auth operations
- Configuration — Environment variables and settings
- Tokens & Sessions — Login response, refresh, logout
- MFA — Multi-factor authentication
- OTP — One-time passcode policies
- OAuth — Google & Facebook integration
- SAML — Enterprise SSO configuration and metadata flow
Security & Operations
- Audience Mapping — Role → audience authorization
- Security Headers — Helmet configuration
- Rate Limiting — Protection against abuse
- Metrics & Health — Health endpoints and Prometheus
- Operations — Kubernetes manifests
- Notifications — Password reset and OTP flows
- Troubleshooting — Common issues and solutions
Passkeys (WebAuthn/FIDO2)
- Passkeys — WebAuthn/FIDO2 implementation details
- ADR-0001: Passkey Attestation — Attestation policy decisions
Enterprise SSO (SAML)
Environment Variables
| Variable | Required | Default | Description |
|---|---|---|---|
JWT_SECRET | Yes | - | Secret for signing JWTs |
JWT_ACCESS_EXPIRY | No | 15m | Access token expiry |
JWT_REFRESH_EXPIRY | No | 7d | Refresh token expiry |
WEBAUTHN_RP_ID | No | localhost | WebAuthn relying party ID |
WEBAUTHN_RP_NAME | No | DigiWedge | WebAuthn relying party name |
WEBAUTHN_ORIGIN | No | http://localhost:3000,http://localhost:4200 | Allowed origins (CSV) |
IDP_PASSKEYS_ENABLED | No | 1 | Enable passkey endpoints (set 0 to disable) |
WEBAUTHN_ATTESTATION_TYPE | No | none | Attestation type |
WEBAUTHN_USER_VERIFICATION | No | preferred | User verification requirement |
ENABLE_SAML_METADATA_REFRESH | No | 0 | Enable scheduled SAML metadata refresh job |
Source Modules
- App:
apps/idp - K8s:
kubernetes/idp/backend/* - Access Control data:
libs/prisma/access-control-client
Related
- Access Control Security — AuthN/Z integration