Demos

The contrib/demo/ directory contains self-contained scenarios that each exercise one or more ahdapa features. Every demo ships with a configuration file, a users template (.toml.in), and a run.sh script. Most scripts exit 0 on pass and 1 on failure and are run as CI integration tests after every successful build.

Quick-start — basic single-node run

For an unstructured single-node session with no particular feature focus, use the top-level script:

bash contrib/demo/run.sh

The script builds the WebUI if webui/dist/ is absent, then locates the ahdapa binary (system-installed PATH → target/release/ahdapa → target/debug/ahdapa → cargo build) and prints the resolved path before starting. It starts ahdapa at http://127.0.0.1:8080 using contrib/demo/ahdapa.sample.toml. Credentials are generated randomly at startup and printed to the console. Press Ctrl-C to stop.

Demo overview

Demo	Features exercised	Interactive
cluster	CRDT gossip, three-node full-mesh, TLS, cross-node token issuance and introspection, DPoP proof (RFC 9449)	yes (`--interactive`)
federation	IdP-to-IdP delegation, OIDC dynamic registration, federated account linking, JWT initial access tokens (RFC 7591 §3), workload federation via `/federation/token`, federation policies, two-node CRDT gossip replication of federation policies	yes (Ctrl-C)
github	GitHub as upstream OAuth2 provider, numeric-ID subject claim	yes (Ctrl-C)
ipa	Ansible-based FreeIPA + ahdapa production deployment	no (infrastructure)
obo	RFC 8693 OBO token exchange, HBAC delegation targets, `act` claim chains, actor gate	yes (`--interactive`)
passkey	WebAuthn credential registration and authentication without FreeIPA	yes (Ctrl-C)
registry	OCI Distribution v2 registry token endpoint, client_secret and JWT-passwordless auth, anonymous pull, HBAC registry-repository/action dimension	yes (Ctrl-C)
ahdapactl	CLI session management, client CRUD, credential generation (client_secret, mTLS, private_key_jwt), key rotation, HBAC lifecycle, audit	yes (`--interactive`)
saml2	Two-instance IdP/SP SAML2 federation, signed assertions, artifact binding, SLO	yes (`--interactive`)
static-clients	TOML-seeded OAuth2 clients, write-protection, identity directory API for SSSD, RFC 8707 resource indicators	yes (`--interactive`)

RFC features with demo coverage

Several RFC features added in recent releases are exercised by the demos above:

RFC 8707 Resource Indicators — the static-clients demo includes a resource-api client with allowed_resources and tests resource-scoped tokens, disallowed resource rejection, and default aud fallback.
RFC 9449 DPoP nonce support — the cluster demo constructs a DPoP proof JWT, verifies the token_type is "DPoP", checks for the DPoP-Nonce response header, and validates the cnf.jkt claim in the access token.
RFC 7591 §3 JWT initial access tokens — the federation demo creates a one-time JWT registration token via the admin API, uses it for dynamic client registration, and verifies that reuse is rejected.
Workload federation (/federation/token) — the federation demo creates a CI-runner client with a federation policy, mints an upstream ID token, and exchanges it via Basic Auth at the /federation/token endpoint for a scoped local access token.

Each demo page describes:

what it shows,
prerequisites,
how to run it (with example output),
how to explore it interactively where applicable.

Common options

Binary selection

All demo scripts use the same binary selection order:

System-installed ahdapa found in $PATH (resolved to its full absolute path).
target/release/ahdapa — a release build in the repository workspace.
target/debug/ahdapa — a debug build in the repository workspace.
Falls back to cargo build (produces a debug binary) if none of the above exist.

The selected path is printed before the server starts:

Using binary: /usr/bin/ahdapa

Log verbosity

All scripts default to RUST_LOG=ahdapa=debug,info (ahdapa debug messages plus info level for all other crates). Set RUST_LOG in the environment before running a script to override:

# Quieter — ahdapa info only
RUST_LOG=info contrib/demo/run.sh

# More verbose — trace everything
RUST_LOG=trace contrib/demo/run.sh

Keyboard shortcuts