STEKOM Passport
The Challenge
Every new internal system meant another user table, another password reset flow, and another place a leaver's account could be forgotten. Consolidating on a single sign-on is the obvious fix, but hosting an identity provider properly is not a weekend job: it needs Authorization Code with PKCE, ID-token verification, RP-initiated and back-channel logout so a logout in one app really ends the session everywhere, and it has to keep working for apps written in three different languages. Buying a hosted IdP was an option, but campus systems needed to stay on infrastructure the university controls.
The Solution
We built an OIDC provider on NestJS 11 and Bun with PostgreSQL and Redis, covering discovery, Authorization Code + PKCE, ID-token verification, and both RP-initiated and back-channel logout. Around it sits a React 19 dashboard for registering applications, managing roles and permissions, handling email verification and invitations, and watching real-time notifications over Socket.IO. Critically, we also shipped typed relying-party SDKs for TypeScript, Python, and PHP — so integrating an existing app is a dependency and a config block, not a fresh OAuth implementation each time.
Identity provider with PKCE + back-channel logout
Typed relying-party clients: TS, Python, PHP
Designed & engineered by Manggala Code
