From 6e172bd528cdd93c572c5deee2af0a96bed3da3a Mon Sep 17 00:00:00 2001 From: William Mantly Date: Sun, 9 Aug 2026 16:09:30 -0700 Subject: [PATCH] release(v2.0.2): rebrand README to Theta Directory, remove standalone-install framing (#185) Removed "Why this over the alternatives"; fixed stale links to the old per-repo GitHub Pages site to point at the unified theta-suite docs site; made explicit this is deployed as part of Theta Suite, not standalone; added the agent capability/install screenshots to the gallery. Co-authored-by: Claude Sonnet 5 --- CHANGELOG.md | 5 ++ README.md | 121 +++++---------------------------------- nodejs/package-lock.json | 4 +- nodejs/package.json | 2 +- 4 files changed, 23 insertions(+), 109 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a1e3eb7..aca8768 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,8 @@ +# v2.0.2 - 2026-08-09 + +### Fixed +- **README rebranding & standalone-install cleanup.** Removed the "Why this over the alternatives" section and stale links to the old per-repo GitHub Pages site (`theta42.github.io/sso-manager-node/`); documentation and secrets links now point at the unified `theta42.github.io/theta-suite/` site. Made explicit that Theta Directory is deployed as part of Theta Suite and isn't installed or run on its own. Added the agent capability/install screenshots to the gallery. + # v2.0.1 - 2026-08-09 ### Fixed diff --git a/README.md b/README.md index 4f0e773..3db74f9 100755 --- a/README.md +++ b/README.md @@ -4,9 +4,12 @@ A production-grade, self-hosted **OpenID Connect provider**, **Resource Director It provides a single source of truth for identity (OIDC + LDAP), host/service directory inventory, access control groups, and secrets management running entirely on your own hardware without third-party cloud lock-in. -> Setting up the full stack (Theta Directory + [Theta Proxy](https://github.com/theta42/proxy) + [Theta Gateway](https://github.com/theta42/jump-host)) with one command? See [theta-suite / theta-env](https://github.com/theta42/theta-suite) — its `./setup.sh` wires everything together automatically. +Theta Directory is deployed as part of [Theta Suite](https://github.com/theta42/theta-suite), +alongside [Theta Proxy](https://github.com/theta42/proxy) and +[Theta Gateway](https://github.com/theta42/jump-host) — it isn't installed or +run on its own. `./setup.sh` wires the whole stack together automatically. -**Documentation:** [https://theta42.github.io/sso-manager-node/](https://theta42.github.io/sso-manager-node/) +**Documentation:** [https://theta42.github.io/theta-suite/sso/](https://theta42.github.io/theta-suite/sso/) ## Screenshots @@ -22,6 +25,10 @@ It provides a single source of truth for identity (OIDC + LDAP), host/service di | --- | | [![Sites](docs/images/sites.png)](docs/images/sites.png) | +| Agent Capabilities & Metrics | Agent Install (Join Key) | +| --- | --- | +| [![Agent capabilities & metrics](docs/images/agent-capabilities-metrics.png)](docs/images/agent-capabilities-metrics.png) | [![Agent install with join key](docs/images/agent-install-join-key.png)](docs/images/agent-install-join-key.png) | + ## Features - **OpenID Connect / OAuth 2.0 provider** — issue your own access, refresh, and @@ -45,87 +52,6 @@ It provides a single source of truth for identity (OIDC + LDAP), host/service di - **Explicit Secret Inheritance Mode** — OpenBao KV-v2 integration with strict upward ancestor lineage (`Resource -> Host -> Cluster -> Site`), preserving precise secret scoping across services and containers. - **Multi-Site Support (Geo-Location Scaling)** — built-in support for N-Way Multi-Master OpenLDAP replication across physical sites for HA and low latency. -## Why this over the alternatives - -Tools like Keycloak, Authentik, Authelia, or Zitadel are OIDC providers, but -LDAP is either a paid feature, a federation target you have to run separately, -or absent. If your stack already has apps that speak LDAP directly (or you just -want one real directory as the source of truth), you end up running *two* -identity systems and keeping them in sync. - -SSO Manager bundles the OpenLDAP directory with the OIDC provider, so OIDC -apps and LDAP apps read from the same users and groups. The trade-off is -scope: it is intentionally small and self-hosted, not an enterprise IAM suite -— no fancy workflow engine, no hosted SaaS. If you want a lightweight, -self-contained identity provider with a real LDAP backend, that is the niche. - -## Quick start - -Three ways to run it, in order of how much it sets up for you: - -### 1. As part of the unified stack (recommended) - -[theta-env](https://github.com/theta42/theta-env) composes this SSO Manager with -the [theta42/proxy](https://github.com/theta42/proxy) (an OIDC-protected reverse -proxy) and generates all the config from a single `setup.env` — you enter your -domain once and it fills in the LDAP DNs, hostnames, OAuth issuer, and random -secrets consistently: - -```bash -git clone --recursive https://github.com/theta42/theta-env.git -cd theta-env -cp setup.env.example setup.env # set CFG_DOMAIN to your domain -./setup.sh # generates ./config/, builds + bootstraps + starts both -``` - -See the [theta-env README](https://github.com/theta42/theta-env) for the full -first-run flow, DNS/port requirements, and backups. - -### 2. Standalone, in Docker - -The all-in-one image bundles the app, OpenLDAP, and Redis. Copy the example -secrets file, fill in your values, and build: - -```bash -git clone https://github.com/theta42/sso-manager-node.git -cd sso-manager-node -mkdir -p config && chmod 700 config -cp secrets.js.example config/sso-secrets.js -$EDITOR config/sso-secrets.js # set ldap.bindPassword, oauth.jwtSecret, ... -docker compose up -d --build -``` - -The web UI comes up at `http://localhost:3001`. To kick the tires with no -config file at all, the entrypoint falls back to safe defaults -(`dc=example,dc=com`, admin password `admin`, an auto-generated JWT) — fine for -a local test, not for production. - -Your domain is entered once, as the LDAP base DN (`stack.ldapBaseDn`); the other -LDAP DNs and the OAuth issuer derive from it and must stay consistent. See -[DEPLOYMENT.md](DEPLOYMENT.md) for the full config reference, the `app_*` env -vars, LDAPS/TLS, and backups. - -### 3. Bare metal on Debian/Ubuntu - -An automated installer installs Node.js, Redis, and (on first run) OpenLDAP — -configuring the directory (modules, overlays, schema, the SSO groups) and -seeding `/etc/sso-manager/secrets.js` with a generated admin password and JWT -secret — then deploys the app to `/opt/theta42/sso-manager` and starts a -systemd service: - -```bash -wget -O - https://raw.githubusercontent.com/theta42/sso-manager-node/master/install.sh | sudo bash -``` - -That's it — LDAP and the app are both live afterward. Edit -`/etc/sso-manager/secrets.js` (org name, SMTP, a non-default base DN, ...) and -restart the service to customize. It's idempotent and safe to re-run — -re-running it updates the app in place (never touching LDAP or the secrets -file again) and prints the version you're updating from and to (e.g. `Updated -v1.1.13 -> v1.1.14`), or `Already up to date` if there's nothing new. Full -details, including env var overrides (`LDAP_BASE_DN`, `SKIP_LDAP`, ...), in -[DEPLOYMENT.md](DEPLOYMENT.md) under *Method 2: Bare metal*. - ## Secrets Secrets are loaded from **OpenBao** at boot via @@ -146,8 +72,8 @@ writes `secret/sso-manager/conf` through `bao-conf.set`. The `config/*-secrets.js` files are operator-edit seed artifacts (gitignored), not the authoritative store. For the full architecture, policies, token model, -and rotation procedure, see theta-env's -**[Secrets docs](https://theta42.github.io/theta-env/secrets/)**. +and rotation procedure, see theta-suite's +**[Secrets docs](https://theta42.github.io/theta-suite/secrets.html)**. ## Architecture @@ -159,7 +85,7 @@ and rotation procedure, see theta-env's │ HTTP/HTTPS ▼ ┌────────────────────────┐ ┌─────────────┐ -│ Express SSO Manager │◄────►│ Redis │ +│ Theta Directory │◄────►│ Redis │ │ - OIDC provider │ │ - sessions │ │ - web UI (:3001) │ │ - models │ │ - management API │ └─────────────┘ @@ -182,30 +108,13 @@ required groups, LDAPS/TLS, direct-bind service accounts) live in: - [DEPLOYMENT.md](DEPLOYMENT.md) — Docker + bare metal, the config layers, the `app_*` env reference, LDAPS/TLS, backups, troubleshooting. - [API.md](API.md) — the management API. -- [docs/](docs/) (GitHub Pages) — the same content broken into - [deployment](docs/deployment.md), [configuration](docs/configuration.md), - [OAuth/OIDC](docs/oauth.md), and [LDAP](docs/ldap.md). +- [docs/](docs/) — the same content broken into + [OAuth/OIDC](docs/oauth.md) and [LDAP](docs/ldap.md), also published at the + unified [theta-suite docs site](https://theta42.github.io/theta-suite/sso/). - [CHANGELOG.md](CHANGELOG.md) — what changed in each release. - All of the above is also readable from the running app itself at `/docs` — no internet access required. -If you are pointing the app at your own existing LDAP server, see -*LDAP requirements* in [DEPLOYMENT.md](DEPLOYMENT.md) — the directory needs the -`pw-sha2`, `ppolicy`, `memberof`, and `refint` modules plus a small custom -schema. The bundled Docker image and `install.sh` set all of that up for you. -Required groups: `app_sso_admin` (full admin), `app_sso_oauth_admin` (manage -OAuth clients only), `app_sso_invite` (invitation management), -`app_sso_directory_admin` (Directory/Plugins/Agent admin) — see -DEPLOYMENT.md for the full setup. - -## Development - -```bash -cd nodejs -npm install -npm run dev # nodemon auto-reload -npm test # jest test suite -``` ## License diff --git a/nodejs/package-lock.json b/nodejs/package-lock.json index 8c9e00b..64efa8e 100644 --- a/nodejs/package-lock.json +++ b/nodejs/package-lock.json @@ -1,12 +1,12 @@ { "name": "t42-theta-directory", - "version": "2.0.1", + "version": "2.0.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "t42-theta-directory", - "version": "2.0.1", + "version": "2.0.2", "license": "MIT", "dependencies": { "@fortawesome/fontawesome-free": "^7.3.0", diff --git a/nodejs/package.json b/nodejs/package.json index eefabd2..c4a2811 100755 --- a/nodejs/package.json +++ b/nodejs/package.json @@ -1,6 +1,6 @@ { "name": "t42-theta-directory", - "version": "2.0.1", + "version": "2.0.2", "description": "A very simple LDAP management and SSO system", "author": [ {