Unified Authentication for Modern Clouds & Legacy Systems
Si-des Auth is a standalone Authorization Server and OpenID Connect Identity Provider uniting modern OAuth 2.0 PKCE with enterprise SOAP 1.1 / 1.2, Argon2id encryption, concurrent session policies, and asynchronous behavioral security telemetry.
RFC 6749 • S256 PKCE
SOAP 1.1 / 1.2 • WSDL
19MiB ≥ 2 iterations
DynamoDB PK/SK + GSI1-4
Interactive Protocol Sandbox Terminal
Execute live requests against Si-des Auth runtime endpoints in REST or Enterprise SOAP.
// POST /oauth/token
{
"grant_type": "authorization_code",
"client_id": "sides_web_portal",
"code": "code_sample_9a8f21b",
"redirect_uri": "https://auth.sides-tech.com/callback",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}Click "Send Live Request" to test the endpoint live against Si-des Auth runtime.
Enterprise-Grade Security Architecture
Engineered to NIST SP 800-63B guidelines, RFC specifications, and zero-trust isolation boundaries.
OAuth 2.0 & OpenID Connect
Strict Authorization Code flow with mandatory S256 PKCE. Short-lived RS256 JWT access and ID tokens, refresh token rotation, and instant family revocation on reuse detection.
Concurrent Session Control
Enforce per-user device limits with configurable policies: Reject new, auto-revoke oldest, or interactive user replacement choice. Cascading refresh token invalidation.
Argon2id & Breach Screening
Memory-hard Argon2id (19 MiB, 2 iterations, 1 lane). Privacy-preserving k-anonymity SHA-1 screening against known compromised credentials without leaking candidate passwords.
Multi-Factor Authentication (MFA)
RFC 6238 TOTP with secure Base32 QR enrollment and drift windows. Single-use 6-digit email OTPs delivered with 5-minute strict validity and attempt rate limiting.
Behavioral Security Analytics
Asynchronous non-blocking telemetry. Impossible-travel evaluation (velocity > 800 km/h flag), credential stuffing detection, progressive lockout, and geographic filters.
GoDaddy Professional Email
Authenticated TLS SMTP delivery via smtpout.secureserver.net (port 465) using sides@sides-tech.com for verification, OTP challenges, and security alert dispatches.
Multi-Tenant Platform & RBAC
A dedicated Platform Console provisions isolated tenant workspaces; every admin action resolves its tenant from the authenticated session, never a client-supplied ID, so cross-tenant access fails closed by construction.
Durable-by-Design Storage & Keys
One storage interface, three interchangeable drivers — DynamoDB in production, a persisted file store in development, in-memory only for tests. Signing keys follow the same rule: persisted by default, real AWS KMS the moment a key ID is configured.
Enterprise SOAP 1.1 / 1.2 Gateway
A hardened XML gateway for legacy systems that can't speak OAuth: XXE-resistant parsing, a 2 MB payload ceiling, published WSDL/XSD contracts, and a controlled SOAP Fault catalogue.
Technology Stack
What actually runs in production today, and what a given feature is implemented against.
TypeScript
Shared types across frontend, API routes, and validation.
Next.js 14 (App Router)
SSR pages, admin/platform dashboards, and API route handlers in one deployable app.
Tailwind CSS
Utility-first styling with light/dark theming.
Custom RS256 engine
Hand-built authorize/token/introspect/revoke/JWKS endpoints (see the docs glossary for why).
Amazon DynamoDB
Single-table design; a file-backed adapter stands in for local development.
Zod
Request and dynamic tenant-profile-schema validation.
Argon2id (@node-rs/argon2)
Memory-hard hashing; scrypt fallback if the native binding is unavailable.
AWS KMS-ready provider
Persisted local key by default; real KMS signing activates via one env var.
GoDaddy Professional Email + Nodemailer
Behind a swappable mail adapter, not hardwired into auth flows.
In-process async dispatch
Roadmap: DynamoDB Streams + AWS Lambda for true out-of-process processing.
Vitest
33 automated tests covering protocol, session, RBAC, and storage-durability behavior.
Vercel + AWS managed services
One coordinated deployment; see the architecture notes in the docs.
Trust Boundaries & Data Isolation
Multi-tenant boundary enforcement and decoupled asynchronous background operations.
Tenant Isolation
All data queries enforce the TENANT#<id> boundary. Cross-tenant queries return 404 Not Found to prevent resource existence disclosure.
Key Management & JWKS
Tokens signed with RS256 through a key provider that persists keys durably by default and switches to real AWS KMS signing once a key ID is configured. Public verification keys are served via /.well-known/jwks.json with overlapping rotation.
Asynchronous Telemetry
Security audit events and behavioral velocity calculations operate out-of-band via background streams so authentication paths remain single-digit millisecond latency.
Operational Guardrails & Cost Transparency
Explicit throughput and storage quotas prevent unexpected cloud resource charges.
What's Coming Next
Deliberately out of the current release — named up front so they're tracked, not assumed.
SAML 2.0 & WS-Federation
Enterprise federation protocols alongside the existing OAuth 2.0 / OIDC surface.
SCIM & LDAP/AD Sync
Automated provisioning and directory synchronization for enterprise IT.
Risk-Based Adaptive Auth
Continuous risk scoring that steps up authentication automatically, not just after the fact.
Fine-Grained Policy Service
An authorization/policy decision service kept separate from core authentication.
Device Authorization Flow & CIBA
Sign-in for input-constrained and decoupled devices, per RFC 8628 and OpenID CIBA.
Multi-Region Resilience
Active-active deployment and automated regional failover beyond the current single-region baseline.