Enterprisey Stack

Small, runnable examples of enterprise authentication patterns. Each demo owns everything specific to its use case, while infrastructure that can be shared by multiple demos lives under shared/.

Demo catalog

Demo	Protocol / pattern	What it demonstrates	Start here
MCP with OIDC	OAuth 2.0 / OpenID Connect	Sign in through an LDAP-backed IdP, use Open WebUI as an MCP client, and forward a bearer token through MCPO to an MCP server	make mcp-dex
Go app with Keycloak	SAML 2.0	Use Keycloak as an IdP and a Go web application as the service provider	make saml
OIDC approvals app	OpenID Connect / OAuth 2.0 + OPA	Use Authorization Code with PKCE, a server-side session, a protected API, and fine-grained policy-as-code	make oidc
SCIM provisioning	SCIM 2.0	Provision users and groups, then prove that account deactivation removes application access	make scim
Device Flow CLI	OAuth 2.0 Device Authorization Grant	Authorize a CLI in the browser, poll for its token, and call a protected API	make device

The demos use different Compose project names and can be run independently. See Repository structure for the placement rules to follow when adding another use case.

Prerequisites

• Docker with Docker Compose
• GNU Make
• Go 1.24 or later for make verify and Go unit tests
• Node.js and npm only when running the browser-level tests
• Python 3.11 only when running the MCP demo's optional local applications
• A patched MCPO base image for the authorization-forwarding experiment, or the documented standard fallback created by make mcp-mcpo-standard-image

List the available commands with:

make help

Run formatting checks, Go unit tests, OPA policy tests, and Compose validation without starting the demo stacks with:

make verify

The first run may pull the version-pinned OPA image used to test Rego policies. The same command runs in GitHub Actions for pushes and pull requests.

The main setup commands are:

Setup	Configure/start	Inspect	Stop
MCP + Dex	make mcp-dex	make mcp-dex-status	make mcp-dex-down
MCP + Authentik	make mcp-authentik-bootstrap, then make mcp-authentik	make mcp-authentik-status	make mcp-authentik-down
SAML + Keycloak	make saml	make saml-status	make saml-down
OIDC web + API	make oidc	make oidc-status	make oidc-down
SCIM provisioning	make scim	make scim-status	make scim-down
OAuth Device Flow	make device	make device-status	make device-down
Shared LDAP only	make ldap	make ldap-status	make ldap-down
Default runnable demos	make all	use the per-demo status commands	make all-down

Dex and Authentik are alternative providers for the same MCP project and should not be started together. make all therefore starts MCP with Dex plus the SAML demo.

Repository layout

demos/
  mcp-oidc/        # complete MCP + OIDC use case
  saml-keycloak/   # complete SAML use case
  oidc-web-api/    # OIDC web session and protected API
  scim-provisioning/ # SCIM identity lifecycle
  oauth-device-cli/  # browser-authorized command-line login
shared/
  ldap/            # reusable OpenLDAP + phpLDAPadmin Compose component
docs/
  repository-structure.md

This repository is intended for local learning and demonstration. Its seeded credentials, development-mode servers, and unencrypted internal traffic are not production defaults.