Unlatch

Unlatch is a single sign-on server you host yourself. It speaks OpenID Connect, so people sign in once and can then use every service you connect to it, such as Grafana, Forgejo or Nextcloud. It is written in Rust with few dependencies and runs as one 9 MB binary with one SQLite file, in about 7 MB of memory.

Unlatch is young: it hasn't been audited or certified yet. The comparison shows how it differs from Authelia, authentik, Kanidm, Pocket ID and Rauthy.

Features

• Sign-in with a passkey, with a password and a code from an authenticator app, or with Google, GitHub and other OpenID providers.
• OpenID Connect for applications that support it.
• Forward authentication through nginx, Traefik or Caddy for applications that don't.
• A web interface for applications, users, groups, sessions and sign-in providers.

Getting started

Download a release, install it with cargo install --locked unlatch, or build it with cargo build --release. To try it on this machine:

(umask 077; unlatch generate-key > key)
UNLATCH_ISSUER=http://localhost:8080 UNLATCH_KEY_FILE=key unlatch

Or with Docker:

docker run --rm ghcr.io/romanok2805/unlatch generate-key > key
docker run --rm -p 127.0.0.1:8080:8080 -e UNLATCH_ISSUER=http://localhost:8080 \
  -e UNLATCH_KEY_FILE=/key -v "$PWD/key:/key:ro" ghcr.io/romanok2805/unlatch

Then open the link from the log, which creates the first administrator. The administrator then connects applications and invites people in the web interface. Running Unlatch shows how to run it on a server, with systemd or Docker Compose.

Documentation

• Running Unlatch: releases, systemd, containers, reverse proxy and backups.
• Configuration: every setting.
• Connecting applications: OpenID Connect settings, what applications learn about users, and examples for Forgejo, Grafana, Immich, Nextcloud, Proxmox VE and Vaultwarden.
• Users and groups: invitations, lost passwords and access by group.
• Sign-in providers: signing in with Google, GitHub and others.
• Forward authentication: protecting services without OpenID Connect.
• Comparison: Unlatch next to other servers you can host yourself.
• Changes

Development

• Architecture: how Unlatch works, why, and what is left out on purpose.
• Threat model: what it protects against and what it doesn't.
• Conformance: results of the OpenID Foundation's test suite.
• Contributing
• Reporting a vulnerability

License

MIT