A high-performance, multi-tenant OAuth 2.0 & OpenID Connect (OIDC) Identity Provider engineered in Python with FastAPI, Uvicorn, and MariaDB. Features native multi-factor authentication with full support for RFC 6238 TOTP and Hardware Tokens like YubiKey, backed by a dedicated Android MFA companion app.
SimpleTessera physically isolates protocol authentication, administration, and MFA verification into dedicated daemons.
Built from the ground up for compliance, performance, and flexibility in home lab and enterprise infrastructure.
Full support for OpenID Discovery, JWKS keysets, Authorization Code with PKCE (RFC 7636), Client Credentials, Refresh Token grant with family revocation, UserInfo, and RP-initiated logout.
Native multi-factor support featuring standard RFC 6238 TOTP (Google Authenticator, Microsoft Authenticator) and physical Hardware Tokens like YubiKey (YubiKey OTP Modhex & FIDO2 / WebAuthn) with realm-level picklists and per-client enforcement.
Partition applications, policies, user directories, and branding by tenant realms. Route tenants using virtual-host domains (e.g., alpha.login.corp.com) with global supervision and fallbacks.
Custom login UI branding with in-database HTML/CSS template editing, reset-to-default capability, and UUID-based multi-client theme linking resolving hierarchically.
Live session monitoring tracking IP address, User-Agent device data, and authorized applications. Configure sliding idle timeouts and execute instant one-click session revocations.
Fail-fast Datastore v4 design cleanly separating administrative operators in UserStore from OAuth configurations in SimpleTessera to prevent privilege elevation and split-brain states.
SimpleTessera provides native enterprise multi-factor authentication with out-of-the-box support for RFC 6238 TOTP authenticators, physical Hardware Tokens like YubiKey, and our native Android MFA companion app.
Seamless compatibility with any standard authenticator app including Google Authenticator, Microsoft Authenticator, Aegis Authenticator, 1Password, and Bitwarden. Uses standard 30-second rolling 6-digit codes with automatic clock-skew compensation and rapid QR code provisioning.
Full support for physical hardware tokens including YubiKey 5 Series, Security Key by Yubico, SoloKeys, and Nitrokey. Authenticate via physical YubiKey OTP (Modhex 44-char) touch generation or FIDO2 / WebAuthn (CTAP2) public-key cryptography via USB and NFC for complete phishing resistance.
End-users independently register, nickname, test, and unenroll their hardware keys and TOTP apps through the dedicated Standalone MFA Portal (port 3443 / 3002 at /portal). Realm administrators define permitted token catalogs globally or enforce mandatory step-up challenges per application client.
A high-performance Android companion application built natively in Kotlin with Jetpack Compose Material 3 for seamless, hardware-encrypted multi-factor authentication.
simpletessera-mfa://enroll.
Integrate any standard OpenID Connect client, backend, single-page app, or mobile client.
| Method | Endpoint Path | Description | Standard |
|---|---|---|---|
| GET | /.well-known/openid-configuration | OpenID Connect Provider Discovery metadata document. | OIDC Discovery |
| GET | /.well-known/jwks.json | JSON Web Key Set (RS256 RSA-2048) public verification keys. | RFC 7517 |
| GET | /oauth/v2/auth | OAuth 2.0 Authorization Endpoint with PKCE challenge verification. | RFC 7636 |
| POST | /oauth/v2/token | Token exchange endpoint (Authorization Code, Client Credentials, Refresh). | RFC 6749 |
| GET | /oauth/v2/userinfo | UserInfo endpoint returning identity claims for Bearer access tokens. | OIDC Core 1.0 |
| POST | /oauth/v2/introspect | Active token metadata and claim introspection. | RFC 7662 |
| POST | /oauth/v2/revoke | Token revocation endpoint for active access and refresh tokens. | RFC 7009 |
| GET | /oauth/v2/logout | RP-Initiated Single Logout with post-logout redirect verification. | OIDC Session |
| POST | /api/mfa/enroll/totp | Initialize RFC 6238 TOTP enrollment (returns QR code URI & base32 secret). | RFC 6238 |
| POST | /api/mfa/enroll/yubikey-otp | Register and validate a physical YubiKey Hardware OTP (Modhex 44-char) device. | Yubico OTP |
| POST | /api/mfa/enroll/webauthn | Register FIDO2 / WebAuthn hardware security keys with public key credentials. | W3C WebAuthn |
| POST | /api/mfa/internal/verify | Inter-service backend verification of MFA challenge during OAuth 2.0 login. | Step-Up MFA |
Deploy SimpleTessera in minutes using systemd, python virtual environments, and Apache TLS reverse proxying.