Arcanada
EN RU
ARCANADA
← Ecosystem / Auth Arcana
BUILDING L2 · target L4

Auth Arcana

Single identity provider for the entire ecosystem.

When every service keeps its own users, passwords and sessions, identity becomes a copy that drifts. Auth Arcana is the single identity provider for the whole ecosystem: every Arcanada service delegates identity to it, and no service runs its own user table.

It is an OIDC/OAuth 2.1 server with Passkeys, federation across 10+ providers (Google, GitHub, Telegram, VK, Yandex, Mail.ru, OK.ru, Apple, Microsoft, Discord), ReBAC authorization via OpenFGA, PAT and API keys, an audit log, and Vault-orchestrated service credentials.

Status
Live, in active build
Autonomy (AAL)
L2 → L4
Protocols
OIDC / OAuth 2.1, OpenFGA
Federation
10+ providers

01

One identity, no copies

Services ask Auth Arcana who the user is instead of storing users themselves.

02

Modern sign-in

Passkeys (WebAuthn) and federation across 10+ providers, on OIDC / OAuth 2.1 with PKCE.

03

Access by relationships

ReBAC authorization via OpenFGA, plus personal access tokens and service accounts with Vault-issued credentials.

What the weakest link taught

The live dual-issuer OIDC provider (.ai/.one) checks its Vault dependency in /health and validates secrets at startup. The remaining gap is a dead-man's switch: a stale AppRole secret-id once ran degraded for about 36 hours with no automated alert (INFRA-0288).

Capabilities

Working now

  • OIDC / OAuth 2.1 with PKCE

Status not stated

  • Passkeys (WebAuthn) and federation (10+ providers)
  • ReBAC authorization via OpenFGA
  • Personal access tokens (arc_pat_*)
  • Service-account flow with Vault credential issuance

Current autonomy level

L2
What levels mean →

Weakest link

Live dual-issuer OIDC IdP (.ai/.one) with a Vault-dependency-validating /health (secrets checked at startup). The cap is the missing dead-man's switch: a stale AppRole secret-id once ran degraded ~36h with no automated alert (INFRA-0288).

Roadmap to L4

  1. L2 lift — /health endpoint, classified errors, deploy reporting to Ops Bot.
  2. L3 lift — pino structured logs to Loki, heartbeat, post-deploy smoke gate, validated credentials at startup.
  3. L4 lift — Vault circuit breaker, PostgreSQL HA fallback, recovery audit log, hard rate-limit CB on every endpoint.

Next step

Review the current build and its development plan

BUILDING means active development, not a promise of public availability. Use the current capabilities and roadmap above as the reference.

Review the path to the target level