IAM
User accounts, authentication and authorization.
Contents
Security
Account Management
User login, user registration, 2FA and profile management.
Automatically secures secrets used by privileged users and machine identities.
Open-source project for login and session management which supports passwordless, social login, email and phone logins.
Modern PHP user login and management framework.
Privacy
A collection of scientific studies of schemes providing privacy by design.
As the world becomes increasingly connected, the email marketing regulation landscape becomes more and more complex.
Cryptography
Zero-trust Network
Identity & Access Proxy and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP requests. Inspired by the BeyondCorp / Zero Trust white paper.
BeyondCorp-inspired Access Proxy server.
An identity-aware proxy that enables secure access to internal applications.
A cloud-native, identity-aware proxy and policy enforcement point that orchestrates authentication and authorization systems via versatile rules, supporting protocol-agnostic identity propagation.
Password-based auth
Multi-factor auth
Password-less auth
Security key
Open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.
Guide to using YubiKey as a SmartCard for storing GPG encryption, signing and authentication keys, which can also be used for SSH. Many of the principles in this document are applicable to other smart card devices.
Public-Key Infrastructure (PKI)
Acts as a broker between CAs and environments, providing a central portal for developers to issue TLS certificates with 'sane' defaults.
A swiss army knife for PKI/TLS by CloudFlare. Command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates.
A suite of network fingerprinting methods to facilitate threat-hunting and analysis.
Authorization
RBAC frameworks
Set of services and libraries supporting service authentication and role-based authorization for provisioning and configuration.
An authorization endpoint to write context-aware access control policies.
Self-hosted, open-source, RBAC system written in Rust.
ABAC frameworks
Policy decision point. It uses a set of access control policies, similar to AWS policies, in order to determine whether a subject is authorized to perform a certain action on a resource.
Access control library, inspired by AWS.
Open-source access control library for Golang projects.
An open-source general-purpose decision engine to create and enforce ABAC policies.
ReBAC frameworks
An open source database system for managing security-critical application permissions inspired by Zanzibar.
Another open-source authorization as a service inspired by Google Zanzibar, and see how it compares to other Zanzibar-inspired tools.
An open-source project which combines the policy-as-code and decision logging of OPA with a Zanzibar-modeled directory.
Open Source administration layer for OPA, detecting changes to both policy and policy data in realtime and pushing live updates to OPA agents. OPAL brings open-policy up to the speed needed by live applications.
A relationship based access control (ReBAC) engine (inspired by Google Zanzibar) also capable of enforcing any authorization paradigm, including RBAC and ABAC.
AWS policy tools
Writing security-conscious IAM Policies by hand can be very tedious and inefficient. Policy Sentry helps users to create least-privilege policies in a matter of seconds.
AWS IAM policy statement generator with fluent interface. Helps with creating type safe IAM policies and writing more restrictive/secure statements by offering conditions and ARN generation via IntelliSense. Available for Node.js, Python, .Net and Java.
GitOps for IAM. The Terraform of Cloud IAM. IAMbic is a multi-cloud identity and access management (IAM) control plane that centralizes and simplifies cloud access and permissions. It maintains an eventually consistent, human-readable, bi-directional representation of IAM in version control.
OAuth2 & OpenID
A curated list of providers, services, libraries, and resources for OpenID Connect.
Open-source OIDC & OAuth2 Server Provider.
Open-source Identity and Access Management. Supports OIDC, OAuth 2 and SAML 2, LDAP and AD directories, password policies.
A UI-first centralized authentication / Single-Sign-On (SSO) platform based. Supports OIDC and OAuth 2, social logins, user management, 2FA based on Email and SMS.
Open-source Identity Provider similar to Keycloak.
An Open-Source solution built with Go and Angular to manage all your systems, users and service accounts together with their roles and external identities. ZITADEL provides you with OIDC, OAuth 2.0, login & register flows, passwordless and MFA authentication. All this is built on top of eventsourcing in combination with CQRS to provide a great audit trail.
A simple authentication system which only implements the relevant parts of the OAuth2 standards.
An IAM infrastructure for modern apps and SaaS products, supporting OIDC, OAuth 2.0 and SAML for authentication and authorization.
Open-source authentication-as-a-service solution. It includes the code for the server, AuthUI, the Portal, and Admin API.
Secret Management
Secure, store and tightly control access to tokens, passwords, certificates, encryption keys.
An alternative to HashiCorp Vault.
Editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP.
Audit git repos for secrets.
Searches through git repositories for high entropy strings and secrets, digging deep into commit history.
Hardware Security Module (HSM)
Open-source project for building trusted execution environments (TEE) with secure hardware enclaves, based on the RISC-V architecture.
A specification and a reference implementation for the secure transfer, storage and processing of data.
Trust & Safety
User Identity
Wordlists for creating statistically likely usernames for use in username-enumeration, simulated password-attacks and other security testing tasks.
An open-source infrastructure for user identity and risk management.
Hunt down social media accounts by username across social networks.
Fraud
Threat Intelligence
“A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.”
An open source intelligence (OSINT) automation tool. It integrates with just about every data source available and uses a range of methods for data analysis, making that data easy to navigate.
that can be leveraged by scammers =to bypass security or fool users.
Collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
CSV database of email addresses used by threat actor in phishing kits.
Tools to scan phone numbers using only free resources. The goal is to first gather standard information such as country, area, carrier and line type on any international phone numbers with a very good accuracy. Then search for footprints on search engines to try to find the VoIP provider or identify the owner.
Blocklists
Hostnames and Subdomains
Consolidates reputable hosts files, and merges them into a unified hosts file with duplicates removed.
Extensive collection of list for security, privacy and parental control.
Mozilla's registry of public suffixes, under which Internet users can (or historically could) directly register names.
CIDR country-level IP data, straight from the Regional Internet Registries, updated hourly.
Top-5000 most common domain prefix/suffix list.
NSA's XKeyscore matching rules for TOR and other anonymity preserving tools.
Emails
A list of temporary email providers. And its derivative Python module
Cross-language temporary (disposable/throwaway) email detection library.
A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).
“A ruby gem to check if the owner of a given email address or website is working for THE MAN (a.k.a verifies government domains).” Good resource to hunt for potential government customers in your user base.