cladone-auth (embedded IAM)

The optional embedded IAM and OIDC issuer — what it runs, how to start it and how Gate One reaches it.

cladone-auth is the optional embedded IAM: a small OIDC issuer and user directory that federates external IdPs, maps their claims to a common roles/scopes/claims model and stores per-user grants. It lets you offer IdP federation and managed users without running Keycloak, Zitadel or another full IAM.

Gate One reaches it as an ordinary OIDC issuer: authProvider.type: "oidc" with issuer pointing at the IAM.

What it is, and what it is not

It is an OIDC issuer/IAM: IdP federation, a user directory, claim mapping, grants, Ed25519-signed tokens, JWKS, discovery and the revocation keyspace Gate One reads.
It is not a full IAM suite: no admin UI, no multi-identity linking, no per-resource policy engine.
It is not an http-bridge: it does not implement the HTTP bridge contract.
It is optional: for a single IdP, point Gate One straight at that issuer and skip the IAM.

Run it

cladone-auth is a single Go binary, shipped signed with each release. It reads its own configuration file (tenants, upstreams, mappings, local accounts, session store):

cladone-auth -check -config embedded-iam.json
cladone-auth -config embedded-iam.json

Then point Gate One at it:

{
  "authProvider": {
    "type": "oidc",
    "issuer": "https://login.example.com",
    "clientId": "gate-one",
    "clientSecretEnv": "OIDC_CLIENT_SECRET"
  }
}

Redis is optional for the IAM and required only when several IAM instances share session/revocation state.

Where to go next

Embedded IAM — why and how, with the claim-mapping model.
Embedded IAM example — a runnable IAM + Gate One configuration.
Embedded IAM configuration reference — every embedded-iam.json field.