Components on Gate One

Reverse proxy

Mon, 01 Jan 0001 00:00:00 +0000

Gate One protects applications as a reverse proxy, but it should itself sit behind a front reverse proxy or ingress controller in most deployments (Traefik, nginx, Caddy, a cloud load balancer).

Why

Gate One listens on plain HTTP and does not manage certificates. The ingress terminates TLS, renews certificates and applies HSTS.
One public entry point gives OIDC redirect URIs, cookie domains and MCP metadata a stable URL that is independent of the container address.
The ingress load-balances and health-checks the Gate One replicas, so the container port never has to be published.
WAF rules, rate limits, request-size limits and access logs stay in front of Gate One instead of competing with its own route policy.
Only the ingress needs to know where Gate One runs; clients cannot reach it directly.

cladone-auth (embedded IAM)

Mon, 01 Jan 0001 00:00:00 +0000

cladone-auth is the optional embedded IAM: a small OIDC issuer and user directory that federates external IdPs, maps their claims to a common roles/scopes/claims model and stores per-user grants. It lets you offer IdP federation and managed users without running Keycloak, Zitadel or another full IAM.

Gate One reaches it as an ordinary OIDC issuer: authProvider.type: "oidc" with issuer pointing at the IAM.

auth-bridge

Mon, 01 Jan 0001 00:00:00 +0000

auth-bridge is the reference implementation of the HTTP bridge contract. Use it when your identity technology is not OAuth/OIDC — SAML, LDAP, mTLS, API keys, a legacy session service — or when you already run auth-bridge in front of Keycloak.

Gate One reaches it with authProvider.type: "http-bridge". The bridge owns the session; Gate One still enforces auth, auth.identity and MCP scope checks on every request.

HTTP bridge contract

Mon, 01 Jan 0001 00:00:00 +0000

authProvider.type: "http-bridge" delegates request verification to an external HTTP service: the bridge. The bridge adapts a technology Gate One does not implement natively — SAML, LDAP, mTLS, API keys, a legacy session service — to three small endpoints and a login page.

Token broker

Mon, 01 Jan 0001 00:00:00 +0000

The token broker is the optional companion service behind Delegated credentials. It holds a registry of OAuth 2.0 providers and an encrypted per-user token store, and hands Gate One the access token of one authenticated user for one provider.

It is deliberately not an identity provider and not a reverse proxy: Gate One keeps its own identity; the broker only obtains and stores the user’s token for an upstream service.

Redis

Mon, 01 Jan 0001 00:00:00 +0000

A single Gate One instance keeps its OIDC session and revocation state in a local bbolt file. That is enough for one instance and needs no Redis.

bbolt is local to the instance and cannot be shared safely by several Gate One replicas: a logout or a back-channel revocation recorded on one node would not be visible to the others. As soon as a second replica runs, that shared state moves to Redis.