Lurus Auth — Unified Identity
Cross-product SSO · Passkey · MFA · OIDC/OAuth2 · enterprise SSO federation
Log in once, access everything. Lurus API, Lucrum, Switch, Creator, Lutu, Admin, Forge, and all other products share the same identity system — when a user logs into any product, the rest recognize them automatically; permissions and quotas are settled uniformly at the account level; and enterprise customers can integrate their own SSO to onboard employees.
The system is served by auth.lurus.cn, built and self-hosted on top of the open-source identity infrastructure Casdoor. It fully implements the OIDC / OAuth2 / SAML standard protocols, and user data remains entirely within Lurus’s own K8s cluster throughout.
Quick links
- User self-service: auth.lurus.cn — change password, manage Passkeys, bind MFA, view login history
- Organization/project management: auth.lurus.cn (Casdoor organization console) — member invitations, permission assignment, and audits for enterprise customers; or contact sales to enable enterprise organization management
Endpoints
Five standard endpoints cover discovery, authorization, token exchange, and reading user information.
| Endpoint | URL | Description |
|---|---|---|
| Console | https://auth.lurus.cn | User self-service for accounts, security devices, and sessions |
| OIDC Discovery | https://auth.lurus.cn/.well-known/openid-configuration | Automatic SDK discovery, including all endpoints and supported capabilities |
| OAuth2 Authorization | https://auth.lurus.cn/oauth/v2/authorize | Entry point for the standard authorization code / PKCE flow |
| Token Endpoint | https://auth.lurus.cn/oauth/v2/token | Exchange for access token / refresh token |
| User Info | https://auth.lurus.cn/oidc/v1/userinfo | Read the current user’s claims |
Core Capabilities
From single sign-on to enterprise SSO federation, one system covers both individual and B2B scenarios end to end.
SSO Single Sign-On
Log in once to access all Lurus products without re-entering credentials. Based on standard OIDC sessions, with silent refresh across applications.
Multi-Factor Authentication / Passkey
Supports TOTP (Authenticator App), U2F hardware keys, and Passkeys (WebAuthn passwordless login). MFA policies can be enforced at the organization or project level.
Social Login
Integrates third-party identity providers such as GitHub, Google, and WeChat; once a user binds an external account, it is linked to their Lurus account.
RBAC and Organization Tiering
Role-Based Access Control. Permissions are granted to specific users or service accounts via Grants, with precision down to the project and application level.
B2B Multi-Tenancy
Multiple Organizations can be created under an Instance, naturally supporting enterprise customer isolation; each organization can independently configure branding, login policies, and IdP federation.
OIDC / OAuth2 / SAML
Full implementation of the three major standard protocols, compatible with mainstream SDKs and frameworks, for seamless integration with Go, Rust, TypeScript, and Flutter applications.
Audit Logs
Key operations such as logins, MFA changes, permission grants, and password resets are all recorded in queryable, immutable logs to meet compliance requirements.
Actions Extensions
Inject custom logic at key points in the authentication flow (such as syncing user attributes or restricting login conditions) without forking Casdoor itself.
Key Concepts at a Glance
The identity system is organized into the following layers; developers and administrators need to understand how these object layers map to Lurus products.
| Concept | Meaning | Mapping in Lurus |
|---|---|---|
| Instance | Top-level deployment unit, with its own database and configuration | Lurus operates a single Instance, hosted at auth.lurus.cn |
| Organization | Tenant isolation unit, with its own user store and login policies | Individual users belong to the lurus.cn primary organization; enterprise customers apply for a dedicated Organization and can configure their own domain and IdP |
| Project | A collection of applications under an Organization, managing roles and grants uniformly | Each product line (Lurus API, Lucrum, Switch, Forge…) corresponds to one Project |
| Application | A specific client within a Project, holding client_id / client_secret | Each frontend, desktop, and server registers a separate Application |
| User | A login-capable account, either Human (a real person) or Service User (a machine) | End users are Human; backend service-to-service calls use a Service User + JWT Profile |
| Grant | The binding relationship that grants a Project Role to a User | Controls a user’s permission level within a specific product; the auth.lurus.cn (Casdoor) organization settings are authoritative |
In This Section
From concepts to integration, dive into each layer as needed.
A detailed breakdown of Instance / Organization / Project / User / Application / Grant.
Password login, Passkeys, social login, and MFA configuration.
Discovery, scopes, claims, the authorization code flow, and PKCE.
Personal Access Tokens, Service Users, JWT Profiles, and token verification.
Day-to-day management of organizations / projects / applications / users.
Working with Other Lurus Products
| Scenario | Path |
|---|---|
| You have an API Key and want to use an OAuth token to call the Lurus API | OIDC Integration → Chat Completions |
| Log in within Switch to sync Lurus account configuration | Login and MFA → Switch Configuration Guide |
| A Forge administrator configuring team permissions | Console Management → Forge |
| A developer writing a backend service that calls the Platform internal API | API Authentication (PAT/JWT) |
| An enterprise customer wanting to log in with their own Azure AD / Feishu | Login and MFA — Identity Brokering |
Further Reading
Built on top of the open-source identity infrastructure Casdoor. For a deeper dive into the underlying mechanisms or SDK details, refer to the upstream documentation:
- Casdoor Documentation Home — getting started, deployment modes, and SDK integration guides
- Core Concepts — explanations of the principles behind Instance, Organization, Project, User, and Grant
- API Reference — REST / gRPC endpoint documentation for the Management API, Auth API, and Admin API