Tenant-aware Single Sign-On for connected applications
Single Sign-On · OAuth2 · OIDC · Multi-tenancy
Single Sign-On for every tenant.
OpenIssuer gives connected applications a tenant-aware Single Sign-On experience through OAuth2 and OpenID Connect, with tenant-scoped issuers, OAuth clients, users, roles, and admin workflows ready to use.
free.openissuer.comIssuer
→
OIDC ClientRedirect + PKCE
→
OrgAdminScoped access
{ "tenant_id": "free.openissuer.com", "scope": ["openid", "profile"] }Capabilities
Built around real authorization workflows.
OAuth2 and OpenID Connect authorization flows
Host-based tenant issuer resolution
Business issuer and OAuth client management
Organization and subdomain admin scopes
User, role, organization, and default-tenant management
NextAuth demo clients for real tenant sign-in
One login, connected apps
Give users SSO without building an identity platform.
Register each application as an OIDC client under the right tenant issuer. Users authenticate with OpenIssuer once, then move between connected apps without signing in again while the tenant keeps its own users, policies, and claims.
- Users start at any connected application.
- OpenIssuer authenticates them at the tenant issuer.
- OIDC returns identity and authorization tokens to the app.
- Other connected apps reuse the active SSO session.
For small businesses
Launch tenant-specific sign-in without rebuilding OAuth.
Each tenant can use its own issuer host, admin portal, OAuth clients, and organization membership while OpenIssuer keeps the platform services shared.
- A business signs up and gets a tenant issuer host.
- Admins create OAuth clients and manage users.
- Applications redirect users to the matching issuer.
- OpenIssuer returns tenant-scoped tokens and claims.
Automated tenant delivery
From an approved request to a working issuer.
OpenIssuer turns tenant provisioning into an auditable workflow. Each request becomes a reviewed Terraform change, then protected automation creates the tenant infrastructure and reports its status back to the portal.
- Submit a tenant request with its issuer, administrator, and region details.
- Review and approve the generated Terraform change through the admin workflow.
- Protected validation and apply jobs create the namespace, databases, routes, and secrets.
- Status callbacks mark the tenant ready so the issuer and admin URLs can be used.
Platform
Designed as a working authorization system.
The project uses Spring Boot, Spring Security, PostgreSQL, Kubernetes Gateway API, and tenant-aware service routing. The public demo signs in through live NextAuth clients for free and business tenants.