FerrisKey
← Modules

Identity Provider Federation

Abyss

Connects FerrisKey to external identity providers. Users authenticate via Google, GitHub, Discord, or any OAuth2 and OIDC provider, and FerrisKey handles provisioning, linking, and attribute mapping.

Read the docs All modules

Covers

Google SSOGitHub SSODiscord SSOOIDCOAuth2Account LinkingAuto ProvisioningAttribute MappingAzure ADCorporate SSO

Key capabilities

What Abyss does for you.

  • 01

    OAuth2 & OIDC

    Connect any OAuth2 or OpenID Connect provider: Google, GitHub, Discord, Entra ID, or a custom corporate IdP.

  • 02

    Auto Provisioning

    New users are created in FerrisKey on their first federated login, with nobody provisioning them by hand.

  • 03

    Account Linking

    A user can link several providers to one FerrisKey account, with Google and GitHub pointing at the same identity.

  • 04

    Attribute Mapping

    Map external claims (email, name, preferred_username) to FerrisKey user fields with required/optional rules.

  • 05

    Secret Encryption

    Client secrets are encrypted at rest and never exposed in plaintext through the admin API.

  • 06

    Per-Realm Config

    Each realm has its own provider registry. Isolate SSO configuration between tenants or environments.

How it works

From the first request to the result, in 4 steps.

  1. 1

    User chooses provider

    On the login page, the user selects an external provider (e.g. "Sign in with Google").

  2. 2

    Redirected to IdP

    FerrisKey builds the OAuth2 authorization URL and redirects the user to the external provider.

  3. 3

    Callback processed

    The IdP redirects back with an authorization code. Abyss exchanges it for tokens and fetches user attributes.

  4. 4

    User provisioned

    Abyss matches or creates a FerrisKey user, applies attribute mappings, and issues FerrisKey tokens.

Ready to use Abyss?

Full reference, configuration options, and examples in the documentation.

Open docs

Other modules