This project is in its very early stages. Tame your expectations and excercise caution.
Quorra is an OIDC compatible IDP (identity provider).
While other providers either use a password, WebAuthn, OTPs or a combination of the three, Quorra uses asymetric encryption. The private key is stored on a device running one of Quorra's keychain apps.
It doesn't aim to be a replacement for other identity providers, instead Quorra is meant to be used alongside other more full-featured IDPs like Authentik, Zitadel, Keycloak, Dex, etc.
As such, Quorra only implements a fairly minimal set of OIDC features and doesn't provide any access controls. It wasn't created to plug directly into your applications, it is to be used as an external identity provider for your existing IDP.
For simple use-cases without the need for fine-grained access policies it can be used by your applications directly.
Registration:
registration.mp4
Login:
login.mp4
Quorra is for everyone, but the main target audience are home users and self-hosters.
As a starting point we provide two first-party apps for two platforms:
- Voucher is a client for Linux written in Python and GTK4/Libadwaita
- Flare is a client for Android written in Flutter
Other applications compatible with LNURL-auth (LUD-04) should work with Quorra out of the box, just without Quorra-specific features.
Tested applications that can be used to hold your private keys:
We hope developers will pick up development of their own authenticator apps for Quorra. The API is documented using OpenAPI and we try to keep it simple.
Everything in Quorra is based either on short-term random secrets or asymetric encryption. No magic involved.
This project is not ready for production use yet and it is too early to start chasing down potential security issues. Anything can change at any point. DO NOT USE IN PRODUCTION unless you're okay with getting pwned.
TODO
If you're ready to start playing with Quorra... TBD
Well, it's complicated... This is my passion project which means I should have fun and enjoy working on it. Handing it to an LLM just seems wrong.
On the other hand, there are some things that I really just don't enjoy doing. I used an LLM to wire up the Alembic migrations, to write some of the JavaScript on the frontend (which is just a pure LLM+human garbage dump but it seems to work well enough) and to come up with a Flutter client.
So like this is not a "No AI" project but it's also not what I'd call AI slop. It's my lovechild that I need help with from time to time.