NanoIDP

A lightweight, configurable Identity Provider for development and testing.
Supports OAuth2/OIDC and SAML 2.0 protocols with a full-featured web UI for configuration.

📖 Documentation

Design principles, non-goals and medium-term direction live in VISION.md.

Features

• OAuth2 / OIDC - OAuth2/OIDC support for development and integration testing: Authorization Code, Password, Client Credentials, Refresh Token, and Device Authorization grants
• PKCE Support - Proof Key for Code Exchange (RFC 7636) with S256 and plain methods
• Security Profiles - stricter-dev (runtime hardening) and oauth21 (draft OAuth 2.1 protocol strictness: PKCE-only S256, rotation, no password grant, registered redirect URIs)
• Token Management - Introspection (RFC 7662) and Revocation (RFC 7009) endpoints
• OIDC Logout - End Session endpoint for RP-initiated logout
• Device Flow - Device Authorization Grant (RFC 8628) for CLI/IoT applications
• SAML 2.0 - SSO and AttributeQuery endpoints with configurable signed assertions and opt-in verification of signed AuthnRequests
• MCP Server - Model Context Protocol integration for Claude Code
• Web UI - Full configuration interface for users, clients, settings, and more
• Persona Login Mode - Passwordless interactive login: pick a configured user from a list instead of typing a password (login.mode: persona), opt-in and off by default, for quick local testing
• YAML Configuration - File-based configuration, no database required
• Attribute-based Access Control - Flexible authority prefixes and claims mapping
• Audit Logging - Track all authentication events
• Docker Support - Ready to deploy with Docker/Docker Compose

Quick Start

pip install nanoidp

python -m nanoidp init    # create ./config (users, settings, keys)
python -m nanoidp         # serve on http://localhost:8000

Get a first token:

curl -X POST 'http://localhost:8000/token' \
  -u 'demo-client:demo-secret' \
  -d 'grant_type=password&username=admin&password=admin&scope=openid'

The admin UI runs at http://localhost:8000. Prefer Docker?

docker run --rm -p 8000:8000 \
  -v $(pwd)/config:/app/config \
  ghcr.io/cdelmonte-zg/nanoidp:latest

Full walkthrough (wizard, custom config paths, docker-compose): Install and Quickstart.

Documentation

The full documentation lives at https://cdelmonte-zg.github.io/nanoidp/:

• Requesting tokens: curl examples for every grant, introspection, revocation
• MCP with Claude Code: drive NanoIDP from an agent
• Security guide: profiles, key management, MCP hardening
• Configuration: users.yaml, settings.yaml, logging
• Endpoints: OAuth2/OIDC, SAML, REST API
• Tokens and claims: token structure and aud semantics
• SAML options: bindings, strict mode, signing, canonicalization
• MCP server: all tools and Claude Code/Desktop setup

Security

NanoIDP is a development/testing tool and must NOT be used in production. Defaults favor convenience (plaintext passwords in config, permissive CORS, open redirects); hardening is opt-in via the stricter-dev (runtime) and oauth21 (draft OAuth 2.1 protocol strictness) profiles and explicit settings. The Security guide draws the line precisely.

Development

pip install -e ".[dev]"
pytest

See CONTRIBUTING.md for the development setup, the end-to-end test agent, code quality tooling, and the release process.

License

MIT License. See LICENSE for details.

❤️ Support NanoIDP

NanoIDP is maintained as an open-source project.

If it helps you test OAuth2, OpenID Connect, or SAML flows, you can support its development here:

• 💖 GitHub Sponsors: https://github.com/sponsors/cdelmonte-zg
• ☕ Buy Me a Coffee: https://buymeacoffee.com/nanoidp