{"slug": "odudu-a-self-hosted-multi-tenant-openid-connect-server-agpl-one-container", "title": "Odudu, a self-hosted multi-tenant OpenID Connect server (AGPL, one container)", "summary": "Wisdom Praise released Odudu v0.1.0-rc.3, a self-hosted multi-tenant OpenID Connect and OAuth 2.0 server that runs as one container plus PostgreSQL and is licensed AGPL-3.0-only. Odudu ships passkeys, recovery codes, single sign-on with back-channel logout, rotating refresh tokens that detect reuse, client credentials and token exchange, an admin API with more than 100 operations, and an MCP server that exposes the admin API to AI agents under the same capabilities as other clients. The release candidate has not had an independent security review, and a hosted service is in the works but not yet for sale or scheduled.", "body_md": "**The sign-in you own: multi-tenant, brandable, and built for apps, MCP servers and AI agents.**\nOpenID Connect and OAuth 2.0, many tenants, one container and PostgreSQL.\n\n**A release candidate.** Odudu has not had an independent security review yet.\nUse it with your own apps and real sign-ins, start small, and tell us what you find.\n\nOdudu signs people in to your apps. It is for teams that want to run their own sign-in, with single sign-on, passkeys and an admin API, and keep their users' data on their own servers.\n\n- Many tenants in one container, each kept apart by the database itself.\n- Passkeys, recovery codes and single sign-on, built in.\n- An admin API and console that cover everything, and access for agents: token exchange, client credentials and an MCP server.\n\n- Authorization code flow with PKCE, always required, plus discovery, signing keys, user info, introspection and revocation.\n- Refresh tokens that rotate, with a stolen one caught on reuse.\n- Client credentials and token exchange, for machines, for agents and for acting on someone's behalf.\n- Single sign-on across a tenant's apps, with back-channel logout.\n- Many tenants on one server, kept apart by the database itself.\n- Passwords with a policy and lockouts, passkeys, authenticator codes and recovery codes.\n- Every page in a tenant's theme and a client's branding.\n- An MCP server that hands an AI agent the admin API as tools, held to the same capabilities as everyone else.\n- An admin API with more than a hundred operations, and a console with a page for every area.\n- An audit trail of every change, sign-in and refusal, filterable and exportable.\n- One container plus PostgreSQL, started with Docker Compose.\n\nYou need Docker with Compose v2 and `curl`.\n\n```\ncurl -fsSLO https://github.com/wizzywit/odudu/releases/download/v0.1.0-rc.3/compose.yaml && docker compose up -d\ndocker compose logs setup\n```\n\nThe second command prints the console address, the administrator's email and a\none-time password. [The quick start](https://wizzywit.github.io/odudu/docs/quick-start/)\ntakes you from there to a signed-in app. This is a release candidate. Try it and\ntell us what breaks. You can also\n[run it from a checkout](https://wizzywit.github.io/odudu/docs/contributing/run-from-a-checkout/).\n\n- [Guides](https://wizzywit.github.io/odudu/docs/guides/) for signing in from a web app, a single-page app, an API or a machine.\n- [Examples](https://github.com/wizzywit/odudu/blob/main/examples) , four small apps that run in CI.\n- [Concepts](https://wizzywit.github.io/odudu/docs/concepts/) ,[operating Odudu](https://wizzywit.github.io/odudu/docs/operating/) and the[reference](https://wizzywit.github.io/odudu/docs/reference/) .\n- [How it compares with Keycloak](https://wizzywit.github.io/odudu/docs/introduction/compare/) .\n\nOdudu is before 1.0, a release candidate. Some of what is described here is\nstill being built. [The roadmap](https://wizzywit.github.io/odudu/docs/roadmap/)\nshows what is ready. A hosted service is in the works. Nothing about it is for\nsale or scheduled yet.\n\nRead [CONTRIBUTING.md](https://github.com/wizzywit/odudu/blob/main/CONTRIBUTING.md) before you send a change, and the\n[code of conduct](https://github.com/wizzywit/odudu/blob/main/CODE_OF_CONDUCT.md). Report a vulnerability privately, as\n[SECURITY.md](https://github.com/wizzywit/odudu/blob/main/SECURITY.md) describes.\n\nThe server, console and tools are AGPL-3.0-only. The guides and the examples are\nApache-2.0. [LICENSING.md](https://github.com/wizzywit/odudu/blob/main/LICENSING.md) says which directory is which.\n\nOdudu and the staff mark are the property of Wisdom Praise. The software is licensed under the AGPL; the name and the mark are used under the trademark policy. The policy is [TRADEMARK.md](https://github.com/wizzywit/odudu/blob/main/TRADEMARK.md).", "url": "https://wpnews.pro/news/odudu-a-self-hosted-multi-tenant-openid-connect-server-agpl-one-container", "canonical_source": "https://github.com/wizzywit/odudu", "published_at": "2026-10-26 10:27:11+00:00", "updated_at": "2026-10-26 10:45:50.813976+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "developer-tools", "ai-tools"], "entities": ["Odudu", "Wisdom Praise", "OpenID Connect", "OAuth 2.0", "PostgreSQL", "Docker Compose", "Keycloak", "MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/odudu-a-self-hosted-multi-tenant-openid-connect-server-agpl-one-container", "markdown": "https://wpnews.pro/news/odudu-a-self-hosted-multi-tenant-openid-connect-server-agpl-one-container.md", "text": "https://wpnews.pro/news/odudu-a-self-hosted-multi-tenant-openid-connect-server-agpl-one-container.txt", "jsonld": "https://wpnews.pro/news/odudu-a-self-hosted-multi-tenant-openid-connect-server-agpl-one-container.jsonld"}}