A secrets and sign-in library for web services, written in Rust.
Auth holds what a service needs to read a credential and to sign a person in, in one place, so a fix lands in every service that uses it at once instead of being copied from one to the next.
Two crates in one workspace, released together under one tag: secrets-rs resolves credentials
from environment variables, JSON files or HashiCorp Vault, and auth-rs signs people in with
their directory account or an API key and keeps them signed in with a browser session.
- One credential model: env vars, a JSON file or Vault KV v2, chosen per credential
- Native Vault: token or Kubernetes auth, several Vaults side by side, each with its own cache
- Read fresh, cache briefly: env and files on every use; Vault for
cache_ttl_seconds - Swappable chain: a configuration reload replaces the resolver under a running process
- LDAP / Active Directory sign-in: search-then-bind, StartTLS or LDAPS, a private CA
- Access rules stay the service's own: any rule type, matched by user name or group
- Login throttle: per-account failure limit, equal timing for wrong users and passwords
- API key middleware: constant-time key check, keys swappable by a reload, open when none
- Browser sessions: in memory, revoked with their key or the LDAP block, CSRF on every write
- Pinned by tag: a service depends on a
vX.Y.Ztag of this repository, never onmain
| Document | What it covers |
|---|---|
| Secrets | The secrets-rs crate: credentials, the backends, build_chain and caching |
| Sign-in | The auth-rs crate: LDAP, access rules, the login, API keys, sessions |
| Development | The workspace, the CI gates, and working on a service against a local copy |
| Releasing | How release-please cuts a version, and how a service moves to it |
Contributions are welcome: CONTRIBUTING.md covers the PR workflow, commit style, CI gates and design rules.
Security issues: see SECURITY.md for private reporting.