Features

wazuh-cert-oauth2 secures agent enrollment and access control for Wazuh using a modern identity + certificate lifecycle. Each feature is documented in its own page.

Identity & access

  • OIDC / OAuth2 agent authentication: agents authenticate through any industry-standard identity provider (e.g. Keycloak) using authorization and client-credentials flows. See Authentication.
  • JWT validation: the server discovers the OIDC issuer, fetches JWKS, and validates token signature, audience, and expiry.

Certificate lifecycle

  • Automatic CSR signing: the client generates a key + CSR; the server signs it to a Root CA. See Certificate issuance & lifecycle.
  • Issuance ledger: every issue/revoke is recorded to a durable CSV ledger for audit and fast revocation lookups.
  • CRL management: revoked certificates are published on a Certificate Revocation List served by the server.
  • Auto-rotate / single-cert policy: re-enrollment overrides and revokes an active certificate for the same subject.

Trust lifecycle automation

  • Event-driven revocation: the Webhook Proxy consumes identity-provider events and revokes the matching certificates automatically. See Automated revocation.
  • Wazuh agent eviction: revoked agents are resolved and removed from the Wazuh Manager, with configurable grace periods. See Agent eviction.
  • Reliable delivery: disk-backed spooling with retry/backoff and dead-letter handling guarantees revocations survive outages. See Reliability & spooling.
  • GitHub integration: new user registrations automatically open a tracking issue. See GitHub issue tracking.

Deployment & infrastructure

  • Nginx CRL sidecar: a reverse proxy validates agent certificates against the live CRL before proxying to authd. See Nginx CRL sidecar.
  • Helm chart: packaged for Kubernetes-based deployments.
  • Zero-trust posture: short-lived identities, per-subject certificates, auditable revocation, and no shared per-agent secrets.

Where to go next

Topic Page
What the software does Features — this page
Each component’s role Components
How the pieces interact Architecture
Wire it up yourself Getting Started

Table of contents


Copyright © 2026 ADORSYS-GIS. Distributed under the MIT license.