Identity and access
Identity & Access Management
In development
A self-hosted OpenID Connect identity provider with an admin console.
IAM runs on your own infrastructure with PostgreSQL. It signs users in over OpenID Connect, using the authorization-code flow, and an admin console manages organizations, users, projects and role grants.
What Identity & Access Management does
Features
Sign-in and tokens
- OpenID Connect authorization-code flow with discovery, token and userinfo endpoints.
- PKCE (S256), required for public clients; refresh tokens issued with the offline_access scope.
- Console, web, browser and command-line applications can all register as clients.
Administration
- Organizations, users, projects and applications managed in one console.
- Role grants to users, with permissions checked on the server for management calls.
- Organization policies for login settings, password complexity and lockout.
- OpenID Connect identity providers can be added as upstream sign-in sources.
Users
- Password self-service, with email reset through your own SMTP server.
- Signed-in users can list and revoke their own sessions.
Audit and operations
- An audit log of management activity, readable in the console.
- Health, readiness and Prometheus metrics endpoints; structured access logs.
- Signed licence key validated offline at start-up.
How it works
You run IAM yourself: a backend, the admin console and PostgreSQL, deployed as a compose stack. An administrator creates an organization, adds users, then registers an application in the console, which returns a client ID, secret and issuer URL. Your application sends users through the OpenID Connect authorization-code flow, then reads the signed-in user from the userinfo endpoint.
Who it is for
Administrators who manage organizations, users and role grants in a single console.
Contact
Talk to us about Identity & Access Management
Questions about Identity & Access Management? Email hello@phron.tech.