Public clients
Use authorization code with required S256 PKCE and no embedded client secret.
Security and trust
Protect the issuer, tenant boundary, and credentials together.
OpenIssuer security depends on consistent host resolution, OAuth client policy, scoped administration, protected key material, and operational controls. This guide distinguishes application controls from deployment responsibilities that operators must enforce.
Trust boundaries
Authorization decisions have multiple scopes.
BoundarySecurity responsibility
Issuer hostSelects tenant clients, authorizations, consent, signing keys, and passkeys.
OrganizationScopes OrgAdmin access and user membership to one organization.
SubdomainScopes SubdomainAdmin access across organizations mapped to one tenant host.
Service identityUses registered OAuth clients and scoped access tokens for service calls.
Kubernetes namespaceSeparates workload, secret, route, and database resource names for an environment.
Tenant isolation
The issuer host selects tenant authorization components.
Tenant hosts select registered clients, authorization records, consent, JWK sets, and passkey credentials. Organization membership and default organization checks provide an additional boundary before tenant-bound user authorization completes.
Forwarded host and protocol headers are security-sensitive inputs. The public gateway must replace untrusted client values and forward only the original host accepted by deployment configuration.
OAuth clients
Apply controls according to client type.
Confidential clients
Authenticate at the token endpoint and store secrets only in protected runtime configuration.
Browser flows
Generate and validate state, nonce, and PKCE values with a maintained OIDC library.
Redirect and post-logout redirect URIs must match registered values exactly. A client registered under one tenant issuer must not be reused against another tenant host.
Signing keys
Each issuer persists its JWK set with authorization data.
OpenIssuer creates an RSA JWK set when an issuer database is initialized and reloads the persisted set on restart. This preserves token validation across pod replacement. The public portion is exposed through the issuer JWK endpoint.
Database and backup access includes signing-key material and must be treated as highly sensitive. Automated key rotation is not documented as an existing platform control; define and test a rotation procedure that overlaps old and new public keys before relying on rotation operationally.
Passkeys
WebAuthn credentials remain issuer and user scoped.
Passkey registration requires an authorization-server session and a trusted HTTPS context. Credentials are stored with the tenant issuer and are not shared across issuer databases. During login, a user with an enrolled credential completes the WebAuthn factor before authorization continues.
Administrative access
Identity does not imply tenant-wide administration.
OrgAdmin assignments are scoped to an organization. SubdomainAdmin assignments are scoped to a subdomain and enable cross-organization views only for that tenant. Downstream organization and user queries must still validate the requested resources against the authorized scope.
Secrets and logs
Prevent runtime credentials from becoming durable records.
The reference deployment loads infrastructure secrets from macOS Keychain and stores Kubernetes values through Secrets or Sealed Secrets. Real tfvars, kubeconfigs, private keys, and unsealed secrets must remain outside Git.
Never log passwords, client secrets, authorization headers, access or refresh tokens, authorization codes, session cookies, or complete request bodies that can contain credentials. Redaction must happen before logs leave the application process.
Production checklist
Verify controls before exposing an issuer.
- Terminate TLS with trusted certificates and redirect all public HTTP traffic to HTTPS.
- Accept forwarded host and protocol information only from a trusted gateway that overwrites client-supplied values.
- Require exact redirect and post-logout redirect URI registration.
- Require S256 PKCE for public clients and use state and nonce for browser flows.
- Keep client secrets, database passwords, API tokens, and Sealed Secrets key material out of source control.
- Redact authorization headers, access tokens, refresh tokens, passwords, secrets, cookies, and authorization codes from logs.
- Restrict database, backup, secret, and JWK access through least-privilege identities.
- Test tenant-boundary and administrative-scope failures as well as successful access.
- Document backup restore, signing-key recovery, rotation, revocation, and incident response procedures.