theta42/sso-manager-node
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

release(v2.0.2): rebrand README to Theta Directory, remove standalone-install framing (#185)

Browse Source 
Removed "Why this over the alternatives"; fixed stale links to the old
per-repo GitHub Pages site to point at the unified theta-suite docs site;
made explicit this is deployed as part of Theta Suite, not standalone; added
the agent capability/install screenshots to the gallery.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-08-09 16:09:30 -07:00
committed by GitHub
parent 3c98cd4596
commit 6e172bd528
4 changed files with 23 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+5
View File
@@ -1,3 +1,8 @@
# v2.0.2 - 2026-08-09
### Fixed
- **README rebranding & standalone-install cleanup.** Removed the "Why this over the alternatives" section and stale links to the old per-repo GitHub Pages site (`theta42.github.io/sso-manager-node/`); documentation and secrets links now point at the unified `theta42.github.io/theta-suite/` site. Made explicit that Theta Directory is deployed as part of Theta Suite and isn't installed or run on its own. Added the agent capability/install screenshots to the gallery.
# v2.0.1 - 2026-08-09
### Fixed
README.md
+15 -106
View File
@@ -4,9 +4,12 @@ A production-grade, self-hosted **OpenID Connect provider**, **Resource Director
It provides a single source of truth for identity (OIDC + LDAP), host/service directory inventory, access control groups, and secrets management running entirely on your own hardware without third-party cloud lock-in.
> Setting up the full stack (Theta Directory + [Theta Proxy](https://github.com/theta42/proxy) + [Theta Gateway](https://github.com/theta42/jump-host)) with one command? See [theta-suite / theta-env](https://github.com/theta42/theta-suite) — its `./setup.sh` wires everything together automatically.
Theta Directory is deployed as part of [Theta Suite](https://github.com/theta42/theta-suite),
alongside [Theta Proxy](https://github.com/theta42/proxy) and
[Theta Gateway](https://github.com/theta42/jump-host) — it isn't installed or
run on its own. `./setup.sh` wires the whole stack together automatically.
**Documentation:** [https://theta42.github.io/sso-manager-node/](https://theta42.github.io/sso-manager-node/)
**Documentation:** [https://theta42.github.io/theta-suite/sso/](https://theta42.github.io/theta-suite/sso/)
## Screenshots
@@ -22,6 +25,10 @@ It provides a single source of truth for identity (OIDC + LDAP), host/service di
| --- |
| [![Sites](docs/images/sites.png)](docs/images/sites.png) |
| Agent Capabilities & Metrics | Agent Install (Join Key) |
| --- | --- |
| [![Agent capabilities & metrics](docs/images/agent-capabilities-metrics.png)](docs/images/agent-capabilities-metrics.png) | [![Agent install with join key](docs/images/agent-install-join-key.png)](docs/images/agent-install-join-key.png) |
## Features
- **OpenID Connect / OAuth 2.0 provider** — issue your own access, refresh, and
@@ -45,87 +52,6 @@ It provides a single source of truth for identity (OIDC + LDAP), host/service di
- **Explicit Secret Inheritance Mode** — OpenBao KV-v2 integration with strict upward ancestor lineage (`Resource -> Host -> Cluster -> Site`), preserving precise secret scoping across services and containers.
- **Multi-Site Support (Geo-Location Scaling)** — built-in support for N-Way Multi-Master OpenLDAP replication across physical sites for HA and low latency.
## Why this over the alternatives
Tools like Keycloak, Authentik, Authelia, or Zitadel are OIDC providers, but
LDAP is either a paid feature, a federation target you have to run separately,
or absent. If your stack already has apps that speak LDAP directly (or you just
want one real directory as the source of truth), you end up running *two*
identity systems and keeping them in sync.
SSO Manager bundles the OpenLDAP directory with the OIDC provider, so OIDC
apps and LDAP apps read from the same users and groups. The trade-off is
scope: it is intentionally small and self-hosted, not an enterprise IAM suite
— no fancy workflow engine, no hosted SaaS. If you want a lightweight,
self-contained identity provider with a real LDAP backend, that is the niche.
## Quick start
Three ways to run it, in order of how much it sets up for you:
### 1. As part of the unified stack (recommended)
[theta-env](https://github.com/theta42/theta-env) composes this SSO Manager with
the [theta42/proxy](https://github.com/theta42/proxy) (an OIDC-protected reverse
proxy) and generates all the config from a single `setup.env` — you enter your
domain once and it fills in the LDAP DNs, hostnames, OAuth issuer, and random
secrets consistently:
```bash
git clone --recursive https://github.com/theta42/theta-env.git
cd theta-env
cp setup.env.example setup.env # set CFG_DOMAIN to your domain
./setup.sh # generates ./config/, builds + bootstraps + starts both
```
See the [theta-env README](https://github.com/theta42/theta-env) for the full
first-run flow, DNS/port requirements, and backups.
### 2. Standalone, in Docker
The all-in-one image bundles the app, OpenLDAP, and Redis. Copy the example
secrets file, fill in your values, and build:
```bash
git clone https://github.com/theta42/sso-manager-node.git
cd sso-manager-node
mkdir -p config && chmod 700 config
cp secrets.js.example config/sso-secrets.js
$EDITOR config/sso-secrets.js # set ldap.bindPassword, oauth.jwtSecret, ...
docker compose up -d --build
```
The web UI comes up at `http://localhost:3001`. To kick the tires with no
config file at all, the entrypoint falls back to safe defaults
(`dc=example,dc=com`, admin password `admin`, an auto-generated JWT) — fine for
a local test, not for production.
Your domain is entered once, as the LDAP base DN (`stack.ldapBaseDn`); the other
LDAP DNs and the OAuth issuer derive from it and must stay consistent. See
[DEPLOYMENT.md](DEPLOYMENT.md) for the full config reference, the `app_*` env
vars, LDAPS/TLS, and backups.
### 3. Bare metal on Debian/Ubuntu
An automated installer installs Node.js, Redis, and (on first run) OpenLDAP —
configuring the directory (modules, overlays, schema, the SSO groups) and
seeding `/etc/sso-manager/secrets.js` with a generated admin password and JWT
secret — then deploys the app to `/opt/theta42/sso-manager` and starts a
systemd service:
```bash
wget -O - https://raw.githubusercontent.com/theta42/sso-manager-node/master/install.sh | sudo bash
```
That's it — LDAP and the app are both live afterward. Edit
`/etc/sso-manager/secrets.js` (org name, SMTP, a non-default base DN, ...) and
restart the service to customize. It's idempotent and safe to re-run —
re-running it updates the app in place (never touching LDAP or the secrets
file again) and prints the version you're updating from and to (e.g. `Updated
v1.1.13 -> v1.1.14`), or `Already up to date` if there's nothing new. Full
details, including env var overrides (`LDAP_BASE_DN`, `SKIP_LDAP`, ...), in
[DEPLOYMENT.md](DEPLOYMENT.md) under *Method 2: Bare metal*.
## Secrets
Secrets are loaded from **OpenBao** at boot via
@@ -146,8 +72,8 @@ writes `secret/sso-manager/conf` through `bao-conf.set`.
The `config/*-secrets.js` files are operator-edit seed artifacts (gitignored),
not the authoritative store. For the full architecture, policies, token model,
and rotation procedure, see theta-env's
**[Secrets docs](https://theta42.github.io/theta-env/secrets/)**.
and rotation procedure, see theta-suite's
**[Secrets docs](https://theta42.github.io/theta-suite/secrets.html)**.
## Architecture
@@ -159,7 +85,7 @@ and rotation procedure, see theta-env's
│ HTTP/HTTPS
▼
┌────────────────────────┐ ┌─────────────┐
│ Express SSO Manager │◄────►│ Redis │
│ Theta Directory │◄────►│ Redis │
│ - OIDC provider │ │ - sessions │
│ - web UI (:3001) │ │ - models │
│ - management API │ └─────────────┘
@@ -182,30 +108,13 @@ required groups, LDAPS/TLS, direct-bind service accounts) live in:
- [DEPLOYMENT.md](DEPLOYMENT.md) — Docker + bare metal, the config layers, the
`app_*` env reference, LDAPS/TLS, backups, troubleshooting.
- [API.md](API.md) — the management API.
- [docs/](docs/) (GitHub Pages) — the same content broken into
[deployment](docs/deployment.md), [configuration](docs/configuration.md),
[OAuth/OIDC](docs/oauth.md), and [LDAP](docs/ldap.md).
- [docs/](docs/) — the same content broken into
[OAuth/OIDC](docs/oauth.md) and [LDAP](docs/ldap.md), also published at the
unified [theta-suite docs site](https://theta42.github.io/theta-suite/sso/).
- [CHANGELOG.md](CHANGELOG.md) — what changed in each release.
- All of the above is also readable from the running app itself at `/docs` —
no internet access required.
If you are pointing the app at your own existing LDAP server, see
*LDAP requirements* in [DEPLOYMENT.md](DEPLOYMENT.md) — the directory needs the
`pw-sha2`, `ppolicy`, `memberof`, and `refint` modules plus a small custom
schema. The bundled Docker image and `install.sh` set all of that up for you.
Required groups: `app_sso_admin` (full admin), `app_sso_oauth_admin` (manage
OAuth clients only), `app_sso_invite` (invitation management),
`app_sso_directory_admin` (Directory/Plugins/Agent admin) — see
DEPLOYMENT.md for the full setup.
## Development
```bash
cd nodejs
npm install
npm run dev # nodemon auto-reload
npm test # jest test suite
```
## License
nodejs/package-lock.json
Generated
+2 -2
View File
@@ -1,12 +1,12 @@
{
"name": "t42-theta-directory",
"version": "2.0.1",
"version": "2.0.2",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "t42-theta-directory",
"version": "2.0.1",
"version": "2.0.2",
"license": "MIT",
"dependencies": {
"@fortawesome/fontawesome-free": "^7.3.0",
nodejs/package.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "t42-theta-directory",
"version": "2.0.1",
"version": "2.0.2",
"description": "A very simple LDAP management and SSO system",
"author": [
{