ssf-transmitter
Standalone OpenID Shared Signals Framework transmitter for self-hosted Authentik deployments, pushing session-revoked and credential-change events to receivers like Apple Business Manager.
Ficha actualizada 23 sept 2026, 4:29 · upstream 23 sept 2026, 4:15 · release v0.5.13
Qué es ssf-transmitter
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
SSF Transmitter is a lightweight, self-hosted service that bridges Authentik's user security events with the OpenID Shared Signals Framework. It forwards real-time logout and password-change notifications as signed RS256 JWT Security Event Tokens (SETs) over HTTPS to configured receivers such as Apple Business Manager. The service requires no SaaS relay or vendor lock-in, runs entirely on-premise, and provides full control over event routing via a Stream Management API. All configuration is managed through environment variables with optional encryption for sensitive tokens.
- Push session-revoked events to Apple Business Manager so users are automatically removed from the directory upon logout
- Forward credential-change notifications (password changes) to an SSF receiver for audit logging and compliance
- Integrate with any SSF-compliant receiver that supports JWT-signed SET delivery, enabling secure event propagation without SaaS dependencies
- Maintain a local copy of authenticated user sessions in the Apple Business Manager directory when using SCIM sync
- Supports multiple receivers via a single stream with fan-out capability for multi-receiver deployments
- All configuration is environment variable-driven with optional Fernet-encrypted tokens stored securely in SQLite
- Every event push includes an RS256-signed JWT, revalidated against SSRF and DNS-rebinding protections before delivery
- Built-in defense-in-depth: receiver hostname allowlisting, per-route rate limiting, and HTTPS-only transport enforced by default
- Apple SCIM group filtering allows syncing only specific authenticated groups to Apple Business Manager
- Only supports one active SSF stream; new streams replace existing ones rather than adding parallel streams
- No persistent storage of user data beyond the SQLite token store; no audit logs or session history persist across restarts
- Email addresses are pseudonymised in logs by default unless explicitly configured to log PII
- Rate limiting is per-route and does not scale with concurrent connections
- SSF discovery requires a .well-known/ssf-configuration endpoint that must be served by the service itself
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Run as a standalone container using Docker Compose or Kubernetes; no external orchestration required for basic operation,Configure environment variables: SSF_ISSUER, SSF_BASE_URL, SSF_MANAGEMENT_TOKEN, and SSF_WEBHOOK_TOKEN,Set SSF_FORWARDED_ALLOW_IPS to restrict the service to your reverse proxy subnet if behind Nginx or Caddy,Register a stream in Apple Business Manager using the provided CAEP endpoint URL before enabling authentication events,For production use, enable SSL/TLS termination via an upstream reverse proxy and configure DNS re-resolving for receiver hostnames,Use Docker Compose to deploy alongside Authentik; ensure port 8000 is available on the service container
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.