AAAX — self-host OpenID Connect authentication server

Self-host OIDC · one Spring jar.

AAAX is a self-host OpenID Connect authentication server for Spring/JVM teams. Clone it. Run it. Own the keys. Not a Clerk console, not Keycloak, not an internet demo. Facts: docs/booklet.md(code wins if it drifts).

Why

Most Spring teams pick a 20-line SAS sample or operate Keycloak. AAAX is a third shape: the authorization server as a readable Spring tree you clone— Endpoint → UseCase → Repository — one jar, keys on your metal.

The craft we already run. Not a feature buffet. Not a SaaS console.

Login → tokens → your apps

Authenticate with AAAX; validate JWTs in your services. Kafka is off by default — not on this diagram.

1Browser/login · PKCE
2AAAXOIDC AS
3Your appJWT · JWKS

Repository layout

com.aaax.server.*

Authentication server — OIDC AS, users, OTP, devices, hosted /login, custom grants. Endpoint → UseCase → Repository.

com.aaax.core.*

Foundation in-tree — BizException, R/Result, AuditEntity, shared utils. No private Maven module.

clone · compose · :8081

git clone https://github.com/yky32/aaax.git && cd aaax
docker compose --profile stack up --build
# http://localhost:8081 — local seed, not production

# optional operator UI (separate repo, points at your jar)
git clone https://github.com/yky32/aaax-portal.git ../aaax-portal
docker compose --profile stack -f docker-compose.yml -f compose.portal.yml up --build
# http://127.0.0.1:5173

Shipped in 0.9

Matches booklet §2 — we do not claim features absent from the tree.

OIDC + RFC 8414

Discovery, JWKS, /oauth2/token (RFC 6749 JSON access_token).

PKCE + hosted /login

Seed public client aaax-pkce; /oauth2/authorize → /login → loopback code.

Register · OTP · password

User registration, OTP flows, custom-password-grant + refresh_token.

Social idToken verify

Google + Apple link/verify — not a separate token grant.

Postgres + Redis local

docker compose --profile stack. Kafka off by default.

Boot 4.1.1 · Java 21

Jackson 3 (tools.jackson); mvn test + CI runtime smoke.

Not in this jar:in-jar /admin · /sign-in product UI · Event Bus catalog · /v1/accounts · Passkeys · SAML · orgs · SaaS console · internet trial account

Operator UI is yky32/aaax-portal — not served from the jar.

Fit

For you

Spring/JVM teams that want a native Java authorization server, clone in five minutes, and keep keys on their own metal.

Not for you

You want a SaaS console, a hosted trial account, or Keycloak-shaped admin in the jar. This site is not a playground.

Positioning

Identity you run.
Keys you own.

Product name: AAAX · license Apache-2.0 · eng SoT:booklet.md