Overview
Built-in portal apps
caddy-security v1.6.2 embeds User Profile, Security Manager, and File Vault. Start with the complete local setup, then follow the User Profile, Security Manager, and File Vault walkthroughs. They cover account self-service, administration, and encrypted document sharing with screenshots. Application links follow the portal mount, enabled APIs and the signed-in account's roles.
Integrate your own application
Choose the integration by where the application accepts identity and who enforces access. Begin with your first protected app if you are new to AuthCrunch.
| Goal | Integration | Access boundary |
|---|---|---|
| Protect an app behind Caddy | Authentication portal and authorization policy | Caddy validates the portal token and application roles before forwarding |
| Protect an app directly with an upstream OAuth provider | Direct OAuth policy | The policy owns an opaque browser session and evaluates claims |
| Let an application use AuthCrunch as an OIDC issuer | OIDC provider | Registered redirect/client, local account authentication, consent and code/PKCE flow |
| Let users sign into the portal through an enterprise SAML IdP | Upstream SAML login | Signed and browser-bound assertions become portal identities |
| Issue AWS console SAML assertions | AWS SSO status | Metadata/menu exist; assertion issuance is incomplete in the released runtime |
The portal's Applications page and UI links help users navigate to services. A link is not an access grant: protect the destination route with its own policy and test a signed-in account without the required app role.
Use the released-version table when choosing features. Upstream provider login, issuing tokens to downstream clients, and presenting a menu are distinct capabilities; one does not imply the others.