Self-hosted identity platform for passwordless auth

VIA's self-hosted Keycloak identity platform — the auth layer other VIA applications build on. It replaces passwords with W3C Verifiable Credentials held in a mobile wallet: scan a QR, present a credential, get logged in over standard OIDC. I develop the platform — the Keycloak plugin, the credential libraries, and the backend services behind it.

Keycloak SPI (Java)Verifiable CredentialsWebAuthn / DIDsPost-quantum crypto

Visit site ↗

The passwordless sign-in the platform delivers — the browser pairs with the VIA Wallet by QR, the wallet presents a Verifiable Credential, and the user is logged in without a password.

The project

VIA builds decentralized data protection for government, defense, and critical-infrastructure customers. I work on the identity platform — a self-hosted, Keycloak-based system that lets people sign in without passwords by presenting a Verifiable Credential from a mobile wallet. Other VIA applications authenticate against it through standard OIDC, so they get modern passwordless auth without handling any of the credential machinery themselves.

The platform lives in one repository ("ZTF") that I develop and maintain: around eight backend services plus shared libraries. At its center is a custom Keycloak authentication plugin (Java SPI) that drives a "scan-a-QR, present-a-credential" login and, on success, issues the ordinary OIDC tokens the rest of VIA's software understands. Around it sit the services that make credentials real — a login-session coordinator (FastAPI), an issuer and a verifier (NestJS), a DID/key registry, and a realm-configuration service — plus TypeScript libraries for building W3C Verifiable Credentials and for browserless WebAuthn.

My work is the platform itself, not its operations: I build and maintain these services and libraries. The platform ships on Kubernetes via ArgoCD, with images in AWS ECR and hardened base containers; I develop against that delivery stack and understand how it works, but a separate function owns running it in production.

What I shipped

Develop and maintain ZTF, VIA's self-hosted Keycloak identity platform — ~8 backend services and shared libraries that other VIA apps authenticate against.
Authored the Keycloak authentication plugin (Java SPI) — the custom authenticators that render the QR login page, poll the login session, verify the presented credential, and complete the flow as standard OIDC.
Designed a shared base ('root') Keycloak theme that ~8 brand and realm login themes inherit from — common FreeMarker templates, assets, and logic in the root, per-theme overrides on top — so a shared UI change is made once instead of repeated across all of them.
Built the credential libraries: a W3C Verifiable Credentials / Presentations library (TypeScript, with Data Integrity proofs) used by the issuer, verifier, and wallet, and a browserless WebAuthn/FIDO2 helper so the mobile wallet can register a device key with Keycloak.
Developed the backend services behind issuance and verification — a FastAPI login-session coordinator, and NestJS issuer and verifier services that build, sign, and validate credentials.
Integrated a hybrid post-quantum cryptosuite (classical + NIST-track lattice signatures) into credential signing and verification, so credentials remain valid through the quantum transition.
Worked across the DID/key registry and realm-configuration service that support encrypted wallet↔app messaging and per-realm feature flags.
Develop against the platform's Kubernetes delivery stack (ArgoCD, AWS ECR, hardened images) — familiar with how services are packaged and shipped, though production operation sits with a separate function.

How it works

Passwordless login flow

Platform components

Challenges worth talking about

Turning "scan a QR + present a credential" into a normal login

Keycloak speaks passwords and OIDC out of the box — not wallets and Verifiable Credentials. I wrote a Keycloak authentication plugin (Java SPI) whose authenticators render the QR page, poll the login-session backend for the wallet's response, and — once the credential checks out — complete the flow so Keycloak issues ordinary OIDC tokens. Every downstream app gets standard OIDC and never has to know a wallet was involved.

Trusting a credential you didn't issue

A presented credential is only as good as its proof. The verifier service checks the presentation's cryptographic signature, confirms the required attributes are present, resolves and validates the issuer's DID and keys through the registry, and honors revocation — so a login succeeds only when the proof, the issuer, and the claims all hold.

Staying secure past the quantum transition

Credentials signed today may need to verify years from now, against adversaries with quantum computers. I integrated a hybrid post-quantum cryptosuite — a classical signature alongside a NIST-track lattice signature — into the credential libraries, so issuance and verification keep working as the ecosystem moves to PQC, without a hard cutover.

Registering a device key without a browser

WebAuthn assumes a browser is present, but the credential lives in a mobile wallet. I built a browserless helper that constructs the WebAuthn registration response (packed attestation, Web Crypto) so the wallet can register a device key directly with Keycloak's WebAuthn MFA — bringing hardware-backed keys into a flow WebAuthn wasn't designed for.

Killing theme duplication across brands

Around eight branded login and account experiences had each been its own full Keycloak theme, so a shared change meant repeating it in all of them. I designed the theme architecture around a base ('root') theme the others inherit from: common FreeMarker templates, styles, and logic live in the root, and each theme keeps only its overrides. A shared UI change now happens once, and a new brand starts from the base instead of a copy.

Stack

Identity & auth

Keycloak
Custom Authenticator SPI (Java)
Keycloak themes (FreeMarker)
OIDC
WebAuthn / FIDO2

Verifiable credentials

W3C VC / VP Data Model
Data Integrity proofs
DIDs
WalletConnect v2

Cryptography

Hybrid post-quantum (NIST lattice)
PBKDF2 / AES-GCM
PKI, JWT

Services & languages

Java
TypeScript
Python (FastAPI)
NestJS
Angular

Data & messaging

PostgreSQL
RabbitMQ

Delivery (familiar)

Kubernetes
ArgoCD
AWS ECR
Hardened images
Helm

Outcomes

Gave VIA's applications one passwordless sign-in they integrate through standard OIDC — no per-app credential or wallet handling.
Contributed the identity/auth work behind the MVP that supported VIA's $28M Series B.
Made issued credentials post-quantum-ready by integrating a hybrid classical + lattice cryptosuite into signing and verification.
Maintain the platform's core repository — ~8 services and shared libraries — as an ongoing developer, keeping the auth layer other teams depend on coherent and buildable.