NexID - Universal Identity Provider in Rust

The Challenge

Building a trustworthy identity provider able to centralize a user's personal data and expose it to third-party applications without ever compromising security or privacy. The challenge was to correctly implement the OAuth 2.1 and OpenID Connect protocols (authorization, token exchange, userinfo, discovery, JWKS), with PKCE enforced, while guaranteeing encryption of sensitive data, GDPR compliance and predictable latency on critical authentication endpoints.

The Solution

Implementation in Rust with Axum, organized into clear modules, crypto (AES-256-GCM, Argon2id), database layer (sqlx + PostgreSQL), OAuth2/OIDC implementation (authorize, token, userinfo, discovery) and security middleware. PostgreSQL stores users, OAuth clients and consents; Redis handles sessions and caching. GDPR is handled end to end (JSON export, right to deletion, granular consents, audit). Rust's memory safety and an optimized release profile (LTO, panic=abort) deliver security guarantees and predictable latency.

Results