Guides by topic
Choose a topic, narrow the document type, or filter by a name you already know. New to AuthCrunch? Follow the learning path for a complete local setup.
Identity providers
Connect local users, directories, and external identity providers.
- Auth0Guide
Connect an Auth0 web application through OIDC, grant access by account ID, and diagnose issuer, email, and custom-claim problems.
- AWS CognitoGuide
Connect a user-pool code-flow client, map Cognito groups and custom claims, and verify member/nonmember application access.
- DiscordGuide
Connect a user OAuth app, filter exact guild IDs, map guild roles to application permission, and test denied identities.
- FacebookGuide
Understand the released Facebook driver compatibility limit, callback and credential requirements, and historical setup screens.
- Generic OpenID ConnectReference
Connect an OIDC service through discovery, validate provider tokens, map groups to application roles, and troubleshoot missing claims.
- GitHubGuide
Add GitHub login to an AuthCrunch portal, grant access by numeric account ID or public organization membership, and troubleshoot callbacks and email claims.
- GitLabGuide
Sign in with GitLab.com or GitLab Self-Managed, filter group paths from UserInfo, and verify application access.
- Google sign-inGuide
Register a Google web client, grant application access by account ID, and understand Workspace domain and Cloud Identity group limits.
Connect a JumpCloud custom SAML application with pinned trust and browser-bound portal login.
- KeycloakGuide
Connect a Keycloak realm to AuthCrunch, map group membership into the ID token, and verify allowed and denied application access.
- LDAP ConfigurationGuide
Connect LDAP over verified TLS, map directory groups to application roles, and distinguish memberOf, secondary searches, and fallback access.
- LDAP user searchConcept
Trace LDAP service binding, escaped user lookup, membership mapping, and password verification, including fallback and failure boundaries.
- LinkedInGuide
Register the current LinkedIn OIDC product, align callbacks, and grant application access by an exact account subject.
Configure a local identity store and connect its realm to the authentication portal.
- Local identity store formatReference
Inspect the local users.json structure, including password policy, user records, and revision metadata.
- Microsoft Entra IDGuide
Connect an Entra tenant, map app roles to protected application access, and handle missing email, group overage, and Microsoft account types.
Configure Entra SAML login, pinned signing trust, required claims and controlled application roles.
Understand why an accepted Nextcloud driver name does not establish native Nextcloud account login.
- OAuth and OIDC providersConcept
Connect an external identity provider to the portal, choose callback URLs and scopes, and turn identity claims into application permissions.
- OAuth provider endpoint settingsReference
Control discovery startup, retries, provider readiness, logout, and the different PKCE defaults of named and generic drivers.
- OktaGuide
Use an Okta custom authorization server, include an ID-token groups claim, and restrict an AuthCrunch application to an assigned group.
- OneLoginGuide
Register a OneLogin OIDC web app, map user roles into ID-token groups, and test member and nonmember access through AuthCrunch.
- Ping IdentityGuide
Connect a PingOne OIDC code-flow web app, match discovery and client authentication, and preserve historical setup screens.
- SAML identity providersConcept
Connect upstream SAML identity providers with signed, browser-bound login and explicit claim mapping.
- Static UsersReference
Define local users, password hashes, and roles inside a Caddyfile identity store.
Configure issuer/audience checks, static PEM key pins and bounded upstream JWKS refresh.
Distinguish Caddy TLS client authentication from AuthCrunch identity providers and token signing keys.
Login and MFA
Configure the portal, authentication challenges, and account enrollment.
Understand how the portal identifies a user and assembles authentication checkpoints.
Define the authentication challenges users must complete, including passwords, application codes, and hardware tokens.
Understand identity sources, login checkpoints, portal tokens, and the separate policy that protects your application.
Use the opt-in browser approval flow that signs another device in, with explicit consent and independent sessions.
Customize portal templates, styles, scripts, links, and login interface options.
- Internationalization (i18n)Reference
Set the portal language and find the translation messages used by the login interface.
- Local login sandboxConcept
Follow a local login through its sandbox session and password or MFA checkpoints.
Require multi-factor authentication for local users and enroll an authenticator application.
- User RegistrationGuide
Collect local registration requests, verify email, and understand the separate approval and provisioning boundary.
Follow a login, open applications, inspect your identity, and manage local passwords and authenticators in the current portal.
Sessions and cookies
Understand tokens, browser cookies, redirects, and logout.
- Authentication cookiesReference
Configure the domain, path, and browser attributes of authentication cookies.
- Authorization redirectsReference
Configure how an authorization policy redirects unauthenticated requests to login.
- LogoutGuide
Configure trusted logout redirects and distinguish portal logout from provider logout.
- Refresh sessionsGuide
Renew short-lived local access tokens with rotating refresh credentials, browser coordination, and explicit native-client transport.
- Token DiscoveryReference
Choose where an authorization policy looks for tokens and the order in which sources are checked.
- Token VerificationReference
Configure token signature verification with shared secrets, asymmetric keys, and key sources.
Limit the destinations accepted by login and logout redirects using domain and path trust rules.
Authorization
Decide who may access each application and pass identity to it.
Allow or deny requests using roles, claims, and ordered access control rules.
Authenticate protected requests using an API key issued by a local portal.
- Authorization overviewConcept
Understand how a policy selects credentials, verifies identity, checks access, and forwards trusted application identity.
- Authorization policy syntaxReference
Look up released policy grammar with precise access-rule, credential-source, forwarding, and version boundaries.
- Basic AuthenticationGuide
Authenticate protected requests with a username, password, and realm.
Exclude selected request paths from authorization with URI matching rules.
- Caddy PlaceholdersReference
Look up user metadata placeholders available to Caddy after authorization.
- Caddy User IdentityReference
Select which token field supplies the user identity returned to Caddy.
Protect an application with provider sign-in and an opaque local session, without creating an authentication portal.
- Identity headersReference
Pass token claims to downstream applications in HTTP headers and strip authentication data.
- IP Address FilteringReference
Match the source address of a request against the IP address recorded in its token.
- Path-Based Access ListsReference
Check a request path against access lists carried in token claims.
- Protect your first appTutorial
Run a local AuthCrunch portal and protect a response with a role-based policy, using a complete tested Caddyfile.
- Typed custom ACL fieldsReference
Bind typed, literal top-level token claims to policy-local ACL aliases in Caddy Security v1.4.0 source.
- User TransformsReference
Map identity claims to roles, login requirements, portal links, and access decisions.
- Verify accessTutorial
Test unauthenticated redirects, allowed and denied users, and logout in the local AuthCrunch walkthrough.
Applications and SSO
Integrate applications with AuthCrunch and identity protocols.
Integrate browser identity displays and login redirects while enforcing application access at the server.
- Applications and SSOConcept
Choose portal authorization, direct OAuth, OIDC issuance or upstream SAML for your application boundary.
Register relying applications, publish discovery and dedicated signing keys, and use code/PKCE login for local AuthCrunch accounts.
Find an example that protects Prometheus, Alertmanager, and Elasticsearch with local, LDAP, and GitHub identities.
Understand the implemented AWS SSO metadata and menu, and the unimplemented assertion-issuance boundary.
Operations
Install, manage credentials and messaging, and diagnose your setup.
- API OverviewReference
Choose the portal, local profile, administrator, or encrypted System API and understand its authentication boundary.
Inspect login and policy failures and filter selected AuthCrunch diagnostic messages without changing access decisions.
- Community examplesReference
Find community-written examples of AuthCrunch integrations.
- Credentials and secret referencesReference
Configure named service credentials, private environment values and optional secret-manager modules.
- Feature availability and versionsReference
Distinguish the released Caddy bundle, its bundled AuthCrunch library, and newer features visible in source checkouts.
- Generate an ECDSA keyReference
Generate matching P-256 PEM signing and verification keys and configure their service paths.
Authenticate an application through the reusable Go client with explicit password, TOTP, API-key, and refresh transport boundaries.
- Install and verifyTutorial
Get the published AuthCrunch bundle, verify its security modules, and prepare a local learning environment.
- Local management CLIGuide
Use the bundled security local commands to authenticate, inspect stores, manage users, and generate private credentials.
Generate bcrypt or Argon2id hashes and change a local password through the current profile interface.
- Messaging providersReference
Configure released SMTP/SMTPS and private file delivery, with accurate registration and template limits.
- Next stepsGuide
Choose an identity provider, add authentication controls, and understand what must change before deploying the local example.
Keep completed sessions and generated keys across restarts using private local storage, with explicit deployment and backup requirements.
- Portal APIReference
Complete JSON login challenges and inspect portal identity, token expiry, and optional upstream ID tokens.
- Portal operations notesReference
Notes on privileged ports, source IP tracking, and authentication portal configuration details.
- Profile APIReference
Manage a signed-in local account through the Profile API, including passwords, authenticators, API keys, and challenge policy.
- Server APIReference
Enable and call administrator APIs for store inspection, user management, reloads, and explicitly permitted private-key export.
- Start hereConcept
Learn how AuthCrunch connects login to application access, then build and verify your first local setup.
- System APIReference
Authenticate remote Basic credentials and API keys through encrypted PASETO System messages with shared key IDs.
- TroubleshootTroubleshooting
Diagnose missing security modules, local startup failures, login redirects, and denied access in AuthCrunch.