# zmartzone/lua-resty-openidc

OpenID Connect Relying Party and OAuth 2.0 Resource Server implementation in Lua for NGINX / OpenResty

Repository: https://github.com/zmartzone/lua-resty-openidc
Canonical: https://ross.abutalabs.com/products/lua-resty-openidc
Language: Lua
License: Apache-2.0
License Family: permissive
Topics: nginx, openidconnect, openidc, oauth2, jwt-bearer-tokens, lua-resty-openidc, lua
Last push: 2026-07-01T14:56:19+00:00

## Health v2 (maintenance only)
Score: 81/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 90, release rhythm 59, longevity 100
- inputs: {"age_days": 4068, "days_push": 63, "days_rel": 63, "gap_med": 655, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1073, forks 254 (observed 2026-08-28T04:03:28.739421+00:00)

## What it is
A Lua library for NGINX/OpenResty implementing an OpenID Connect Relying Party and OAuth 2.0 Resource Server. It authenticates users via OpenID Connect Discovery and validates OAuth 2.0 bearer tokens, enabling reverse proxies to protect origin services without native auth support.

## Use cases
- add OpenID Connect login to an NGINX reverse proxy
- protect backend APIs with OAuth 2.0 bearer token validation
- validate JWT access tokens at the gateway
- terminate authentication in front of legacy origin servers
- introspect opaque access tokens against an authorization server
- manage authenticated user sessions in cookies, redis, or memcache

## When to choose
- you run NGINX or OpenResty and need standards-based OIDC/OAuth2 at the proxy layer
- your origin servers cannot implement OpenID Connect themselves
- you need OpenID certified Relying Party behavior with discovery and code flow
- you want flexible session storage (cookie, shared memory, memcache, redis)

## When to avoid
- you are not using NGINX/OpenResty as your gateway
- you need a full identity provider rather than a relying party/resource server
- you prefer application-level auth handled inside your app framework
- you need OAuth flows beyond the authorization code and bearer token use cases

## Facets
- artifact type: library
- maturity: stable
- function: auth, authorization, middleware, http-server
- domain: security, web-development, apis, backend
- platform: lua
- tags: openid-connect, oauth2, jwt, reverse-proxy, nginx-lua, session-management, identity, nginx, openresty, linux

## Member repositories
- zmartzone/lua-resty-openidc (main) score 81

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:28.739421+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:53:39.242369+00:00, confidence not recorded.
  - readme: https://github.com/zmartzone/lua-resty-openidc (fetched 2026-08-28T04:03:28.739421+00:00, sha c37d6cbc19c1)
- Data as of 2026-08-30T08:39:29.467469+00:00.