Rauthy

Locate the Rauthy on Ubuntu 24.04 LTS image by SecureAnyCloud in the Azure Marketplace and select Create.

Choose your subscription, resource group and region.

Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

On the Networking tab, allow inbound 443 and 80 from the clients and applications that will use single sign-on. Restrict 22 to your management network.

Review and create the VM. When the VM is running, browse to https://<your-public-ip>/auth/v1/account.

You can deploy the same image from the Azure CLI. Replace the resource group, location and image URN with your own values:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rauthy-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rauthy-rg \
  --name rauthy \
  --image sac1647283583153:rauthy-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# then open the required ports
az vm open-port --resource-group my-rauthy-rg --name rauthy --port 443 --priority 1001
az vm open-port --resource-group my-rauthy-rg --name rauthy --port 80 --priority 1002

SSH in as azureuser. Confirm that the services are active, that Rauthy and its Raft ports are bound to loopback only, and that nginx is the only public listener:

sudo systemctl is-active rauthy nginx rauthy-firstboot

ss -tln | grep -E ':8080|:8100|:8200|:80 |:443 '

You should see Rauthy on 127.0.0.1:8080 and its Raft ports on 127.0.0.1:8100 and 127.0.0.1:8200 (all loopback only), while nginx listens on 0.0.0.0:80 and 0.0.0.0:443.

Rauthy publishes its OpenID Connect configuration at the standard discovery URL. Confirm that it answers over TLS and shows the issuer and the core OIDC endpoints your applications will use:

curl -sk https://127.0.0.1/auth/v1/.well-known/openid-configuration | python3 -m json.tool

The issuer is the public URL of this instance, and the document advertises the authorization, token, userinfo, introspection, revocation and JWKS endpoints under /auth/v1/oidc/.

The unique admin password generated for this VM on first boot is written to a root-only file. Read the file to get the admin email and password:

sudo cat /root/rauthy-credentials.txt

The default admin user is admin@localhost. Note the rauthy.admin_password value. You will use it to sign in in the next step, and you should change it immediately afterwards.

Browse to https://<your-public-ip>/auth/v1/account. The certificate is self-signed and generated per VM, so your browser warns about it on the first visit. Accept the warning, or install your own certificate (see Step 13).

The Rauthy sign in form appears. Enter the admin email admin@localhost and select Login, and then enter the per-instance password from Step 5.

After you sign in, you land on the account page. It shows the admin user's details: email, given and family name, the rauthy_admin and admin roles, whether MFA is activated, and login and password metadata. From here you can manage MFA keys, devices, profile details and your password.

Open the Password tab. Rauthy shows the active password policy (minimum length, character classes and password history) and lets you set a new password or generate a strong one. Change the per-instance admin password to one you control as your first action after signing in.

Use the Edit tab to maintain the admin user's profile details, including email, name, timezone and an optional preferred username. Rauthy exposes these standard OIDC claims to your connected applications.

The image ships a self-test that proves the per-instance admin credential authenticates end to end over TLS. It performs the real OIDC login flow. It rejects a wrong password with 401, and then accepts the correct per-instance password with 202 and an issued authorization code:

sudo /opt/rauthy/rauthy-selftest.sh

The expected output reports round-trip OK, confirming the wrong password was rejected and the correct password was accepted over TLS.

The exact Rauthy version and the official source image digest baked into the image, along with the per-VM appliance details, are recorded on the VM:

cat /opt/rauthy/VERSION

sudo cat /root/rauthy-credentials.txt

Rauthy's full admin console, at /auth/v1/admin, lets you manage users, OIDC and OAuth2 clients, roles, scopes, groups, sessions and events. As a security measure, Rauthy requires the admin account to have multi-factor authentication (a passkey) enabled before it will open the admin console.

From the account page (Step 7), open the MFA tab and choose Register New Key to enrol a passkey. Then log out and log back in. Passkeys require a real domain name, so enrol your passkey after you have pointed a DNS name at the instance and set the public URL (Step 13).

The image ships a self-signed certificate and is served on the instance's IP address. It is secure out of the box, but browsers warn about the certificate and passkeys cannot be enrolled against a bare IP. For production, point a DNS name at the VM, set the public URL, and install a CA-signed certificate.

First, set the public URL and WebAuthn settings so that the OIDC issuer and passkeys use your domain. Edit /etc/rauthy/firstboot.env, set PUB_URL, RP_ID and RP_ORIGIN to your domain, and then restart Rauthy:

sudo sed -i \
  -e 's#^PUB_URL=.*#PUB_URL=<your-domain>#' \
  -e 's#^RP_ID=.*#RP_ID=<your-domain>#' \
  -e 's#^RP_ORIGIN=.*#RP_ORIGIN=https://<your-domain>:443#' \
  /etc/rauthy/firstboot.env
sudo systemctl restart rauthy

Then obtain a free CA-signed certificate for your domain from Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Certbot installs the certificate into nginx and sets up automatic renewal.

sudo systemctl restart rauthy

sudo journalctl -u rauthy.service --no-pager | tail -20

Rauthy's configuration lives in /etc/rauthy/config.toml (static settings) and /etc/rauthy/firstboot.env (the per-instance secrets and public URL). After you edit either file, run sudo systemctl restart rauthy.

• Change the admin password immediately. The per-instance password in /root/rauthy-credentials.txt is for the first sign-in only. Change it from the account page (Step 8) as your first action.
• Restrict SSH. Allow inbound 22 only from your management network. Keep 443 (and 80 for the redirect) open to the applications and users that need single sign-on.
• Install a trusted certificate and a real domain. Replace the self-signed certificate with a CA-signed one (Step 13) so that users are not trained to click through warnings and so that passkeys can be enrolled.
• Enable MFA on the admin account. Rauthy already requires a passkey for the admin console. Enrol one as soon as you are on your own domain.
• Keep the image updated. Unattended security upgrades remain enabled so that the OS keeps receiving patches.

Rauthy is open-source software distributed under the Apache License 2.0. This image bundles the upstream Rauthy release unmodified, and the licence is retained on the image. SecureAnyCloud provides the packaging, hardening and support.

Deploy on Azure

Find this image on the Azure Marketplace and deploy it in minutes. See secureanycloud.com for the full catalogue.

Need Help?

SecureAnyCloud provides 24/7 support with a guaranteed 24 hour response SLA. Contact us through secureanycloud.com for deployment assistance, configuration help or any questions about this image.

Deploy on Azure

Launch Rauthy on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com