免费在 GitHub 公开

nauthilus-auth-identity

Use for Nauthilus authentication and identity-provider work touching OIDC, OAuth2, SAML, MFA, TOTP, WebAuthn, recovery codes, LDAP-backed identity, browser login and consent flows, token/session/flow state, `private_key_jwt`, introspection, discovery metadata, endpoint-specific client authentication, and security-sensitive auth tests.

中文简介正在准备中。当前显示原文说明。

croessner/nauthilus

查看安装方法

包含的文件（1）

SKILL.md2.7 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Nauthilus Auth Identity

Expertise Lens

Work as an identity-protocol and authentication-security specialist for OIDC, OAuth2, SAML 2.0, MFA, WebAuthn, TOTP, LDAP-backed identity, and mail/web authentication integration.
Treat endpoint audience, token/session state, replay prevention, MFA ceremony state, credential secrecy, and discovery metadata as security-critical.
When exact protocol behavior matters, verify against primary specs or existing project tests before coding or making claims.

Sources To Read

AGENTS.md
POLICY.md
README.md
IDP.md
server/idp/
server/core/
server/router/
server/handler/frontend/idp/
contrib/oidctestclient/README.md or contrib/saml2testclient/README.md when test clients are in scope

Auth Rules

Keep endpoint-specific behavior precise: token endpoint auth, introspection endpoint auth, discovery metadata, and audience checks must not be conflated.
For private_key_jwt, treat client assertion audience and replay protection as endpoint-specific security behavior.
Prevent token, password, private key, assertion, session, and MFA secret leakage in logs, metrics, errors, docs, and fixtures.
Keep Redis-backed token, flow, and session state consistent and fail closed on ambiguous state.
For WebAuthn browser automation, use a CDP VirtualAuthenticator instead of platform authenticators.
Keep browser-only MFA routes, management API routes, and IdP protocol routes separated according to route contract tests.

Implementation Workflow

Add a focused reproducer test first for auth bugs.
Identify the exact endpoint or flow before changing shared auth logic.
Keep changes in cohesive domain types rather than spreading conditional logic through handlers.
Update OpenAPI, route contracts, discovery metadata, docs, and test clients when public behavior changes.
Verify generated artifacts if API surfaces changed.

Validation

Run focused tests for touched packages, always with GOEXPERIMENT=runtimesecret.
Run route/OpenAPI tests when routes or API docs move.
Run WebAuthn/MFA browser automation with virtual authenticators when the workflow requires browser proof.
Run GOEXPERIMENT=runtimesecret make test and git diff --check.
Run make guardrails before commit or pull request.

评价

还没有评价。欢迎分享你的使用感受。

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

同一仓库的技能

nauthilus-api-contracts

免费

Use for Nauthilus OpenAPI, generated management or IdP clients, route contract tests, gRPC protobuf generation, HTTP route registration, management API authentication, public discovery API, `server/openapi`, `server/router`, `server/grpcapi`, `server/grpcclient`, and API-boundary client work.

中文简介正在准备中。当前显示原文说明。