pykrete
Authentication & authorization server
Pykrete: OIDC, SAML, LDAP and Kerberos under one roof.
OIDC
Standard authorization flows for web apps, SPAs, native clients and device-code logins.
LDAP / Kerberos
Bridge legacy infrastructure without giving up modern federated identity.
End-to-end keys
Application keys are derived client-side; the server never sees unwrapped key material.
Implemented specifications
- RFC 6749 — OAuth 2.0 authorization framework
- RFC 7636 — Proof Key for Code Exchange (PKCE)
- RFC 8628 — OAuth 2.0 device authorization grant
- RFC 7591 — OAuth 2.0 dynamic client registration
- RFC 7519 — JSON Web Token (JWT)
- RFC 7515 — JSON Web Signature (JWS)
- RFC 7516 — JSON Web Encryption (JWE)
- RFC 7517 — JSON Web Key (JWK)
- OpenID Connect Core 1.0
- OpenID Connect Discovery 1.0
- Firefox Accounts scoped keys — client-side scoped key derivation (
identity.mozilla.com/picl/v1/scoped_key)