LinId Identity Manager

🚀 Overview

LinId Identity Manager is a platform designed to manage user identities, access rights, and application permissions within an organization.

It provides a centralized way to:

• Manage user accounts and organizational structures
• Define and control application-level permissions
• Configure authentication and identity flows
• Dynamically generate access rights using policy-based logic

🎯 Purpose

LinId helps organizations:

• Centralize identity and access management (IAM)
• Automate permission assignment
• Standardize authentication and authorization across applications
• Reduce complexity in multi-application environments

🧩 Key Features

• 👤 User Management

  • Manage user accounts
  • Assign users to Organizational Units (OU)
  • Manage account status (Active, Inactive, Suspended)

• 🏢 Organizational Structure

  • Create and manage Organizational Units
  • Structure users logically within the organization

• 📦 Application Management

  • Register applications
  • Define application-specific roles
  • Configure authentication per application

• 🏷️ Organizational Roles

  • Create and manage organizational roles
  • Assign roles to users

• 🔐 Authentication (OIDC)

  • OIDC-based authentication
  • Integration with LemonLDAP
  • Certificate-based configuration

• 🧠 Policy-Based Authorization (PBAC)

  • Use OPA (Open Policy Agent) scripts
  • Dynamically generate user permissions per application

• 🏷️ Claims Management

  • Define and map claims required by applications
  • Customize identity payloads per application

• 🎨 UI Customization

  • Theme configuration
  • Externalized translations (i18n)
  • Customizable dashboard (Apache Superset™)

👥 Target Audience

• Enterprises managing internal access control
• SaaS platforms requiring multi-tenant identity management
• DevOps / IAM / Security teams

🧪 Project Status

🚧 This project is currently under active development.

Features and APIs may evolve.

---

⚡ Quick Start

🚧 Minimal setup to run LinId Identity Manager in under 5 minutes

LinId provides a Taskfile to simplify running the demo environment. All you need is Docker and Task installed on your machine.

---

1️⃣ Prerequisites

• Docker 24+ and Docker Compose 2+
• Task (https://taskfile.dev/#/installation)

⚠️ Make sure Docker is running before executing any tasks.

---

2️⃣ Install LinId Repository

git clone https://github.com/linagora/linid-identity-manager.git
cd linid-identity-manager
git submodule update --init --recursive

---

3️⃣ Run the Demo

1. Use the provided Taskfile to start the demo:

task setup:demo
task start:demo

2. The task will automatically:

• Start the backend, frontend, and database containers
• Configure LemonLDAP demo environment
• Apply initial configuration for quick testing

👉 Access the demo: https://linid.localtest.me:9000

---

4️⃣ Access the Application

• Backend API: https://localhost:8443/swagger-ui/index.html
• Frontend UI: https://linid.localtest.me:9000
• LemonLDAP portal: http://localhost:8080 (pre-configured demo)
• Apache Superset™: http://localhost:8088

Demo credentials

Application	Username	Password
LemonLDAP::NG	admin	password
LemonLDAP::NG	user1	password
LemonLDAP::NG	user2	password
Apache Superset™	superset	password

---

📝 Notes

• task start:demo is intended for quick testing / development only
• For custom environments, use the Docker folders with their README (docker/<environment>/README.md)
• No manual configuration required for the demo

---

📚 Documentation

Full documentation is available in the /docs directory.

It includes:

• Getting started guides
• Installation instructions
• Configuration references
• Advanced topics

---

🛠️ Installation

LinId provides Docker-based environments for running the application.

See: docs/installation

---

🔐 Authentication

LinId supports OIDC-based authentication.

Supported Providers

• LemonLDAP

Certificates

Authentication requires certificate configuration.

See: docs/configuration/certificates

---

⚙️ Configuration

LinId is highly configurable and supports multiple configuration domains:

📄 Application Configuration

• YAML-based configuration files
• Environment-based overrides

See: docs/configuration/application/

---

🔐 Authentication Configuration

• OIDC setup
• Provider integration
• Certificate management
• Claims mapping

See: docs/configuration/authentication/

---

🧮 Authentication Claims mapping (OPA / Rego rules)

Access decisions and role assignments are computed per application by Open Policy Agent (OPA). For each application, LinId compiles all of its active rules into a single OPA policy written in Rego, and deploys it automatically to the internal OPA server.

What is Rego?

Rego is OPA's declarative policy language. Instead of writing imperative code, you declare rules that OPA evaluates against an input document (describing the user) to produce a decision. In LinId, a rule is a small, self-contained Rego fragment that contributes to two shared sets:

• roles — the roles granted to the user.
• signals — the access decision signals: allow, force_allow (wins over allow) and force_disallow (denies, wins over everything).

Writing a rule (mini tutorial)

A rule must only contribute to the shared sets with contains (it must never reassign them with :=):

# Grant the "reader" role and allow access to members of the "public" organizational unit.
roles contains "reader" if {
    input.user.organizationalUnit == "public"
}

signals contains "allow" if {
    input.user.organizationalUnit == "public"
}

Unconditionally grant access to administrators, overriding any plain allow:

signals contains "force_allow" if {
    input.user.admin == true
}

Always deny suspended users, overriding everything else:

signals contains "force_disallow" if {
    input.user.suspended == true
}

The generated policy resolves these signals into a single result:

{ "allow": true, "roles": ["admin", "reader"] }

See the full rule authoring guide, the fragment contract and more examples in docs/advanced/policies.md.

---

🔌 Plugins

LinId is designed to support a plugin system.

🚧 Plugin system is not fully documented yet

Planned documentation:

• Plugin architecture
• Installing plugins
• Plugin configuration

---

🎨 UI Configuration

• Theme customization
• Branding
• Externalized translations (i18n)
• Customizable dashboard (Apache Superset™)

See: docs/configuration/ui/

---

🧱 Tech Stack

• Frontend: Quasar / Vue / Module Federation
• Backend: Java / Spring Boot / Spring Plugin
• Database: PostgreSQL
• Directory / IAM: LemonLDAP
• Policy Engine: OPA (Open Policy Agent)
• Dashboard engine: Apache Superset™

---

🤝 Contributing

Contributions are welcome.

Please refer to the CONTRIBUTING file for guidelines.

---

📜 License

This project is licensed under the:

GNU Affero General Public License (AGPL)

---

🆘 Support

For questions, issues, or feature requests:

👉 Use GitHub Issues