aip-lite #

A single-tenant OpenID Connect provider whose only sign-in method is AT Protocol OAuth.

Early alpha. aip-lite is an early-alpha project and needs further testing before anyone relies on it. Version 1.0.0-rc.1 is a release candidate: the specified behavior is implemented and covered by the automated test suite and a run against local AT Protocol servers, but it has not yet been verified with real accounts on public servers, run through a full OpenID Foundation conformance plan, or operated in production. Expect changes, and report what breaks. The open items are listed in openspec/aip-lite.md §25.

A relying party sends a user to aip-lite. aip-lite sends them to their own PDS or entryway to sign in, verifies that the DID that came back belongs to the server that answered, and returns an ID token whose sub is that DID. Relying parties are a short list fixed in configuration; there is no dynamic registration, no app passwords, and no device flow.

• Upstream: a confidential AT Protocol OAuth client: PAR, PKCE, DPoP-bound tokens, private_key_jwt, RFC 9207 iss checking, and subject binding.
• Downstream: the OIDC authorization-code flow with PKCE required (a confidential client may opt out), ES256 ID tokens, UserInfo, refresh-token rotation, RFC 7009 revocation, optional DPoP, and SSO across relying parties.

The specification is in openspec/: capability specs under openspec/specs/ and the technical companion openspec/aip-lite.md. The acceptance checklist, with the evidence and status of each criterion, is §20.3 of the companion, and how to run aip-lite is in docs/operations.md.

Quick start #

Rust 1.97 (pinned in rust-toolchain.toml).

cargo build --release
export AIP_LITE_CLIENT_KEYS=$(./target/release/aip-lite keygen 2>/dev/null)
export AIP_LITE_SIGNING_KEYS=$(./target/release/aip-lite keygen 2>/dev/null)
export AIP_LITE_SEALING_KEYS=$(./target/release/aip-lite sealing-keygen)
export EXAMPLE_APP_SECRET=$(openssl rand -base64 48)
./target/release/aip-lite check-config -c config/example.toml
./target/release/aip-lite serve -c config/example.toml

The issuer must be a public HTTPS URL for upstream sign-in to work; see docs/operations.md.

Testing #

cargo test                                  # unit and integration tests
cargo test --test live -- --ignored         # discovery against real servers
scripts/live-check.sh                       # bsky.social accepts aip-lite as a client (needs cloudflared)

The integration tests run aip-lite against a fake PDS and authorization server over real TLS. The fake verifies client assertions, DPoP proofs with a nonce challenge, PKCE and single-use codes. tests/oidc_library.rs drives the whole flow with the unmodified openidconnect crate.

The atproto-crates dependencies are git dependencies pinned to one commit, because 0.15 isn't on crates.io yet.

Credits #

aip-lite is seeded from AIP by Graze Social, an OAuth 2.1 authorization server with AT Protocol integration. It keeps AIP's MIT licence.

License #

MIT. See LICENSE.