islamawad/idenplane repository overview

⁠Idenplane

The identity control plane you own.

Self-hosted, open-source Identity & Access Management server — a lightweight alternative to Keycloak and Auth0. Built with TypeScript, NestJS, and PostgreSQL. Runs in ~150 MB of RAM (vs Keycloak's 1 GB+).

⁠Quick Start

curl -o docker-compose.yml \
  https://raw.githubusercontent.com/idenplane/idenplane/dev/docker-compose.yml

# Required: set an admin API key (32+ chars)
export ADMIN_API_KEY=$(openssl rand -hex 32)
export ADMIN_PASSWORD=$(openssl rand -hex 16)

docker compose up -d

Then open:

Default admin: admin / value of $ADMIN_PASSWORD.

⁠What you get

⁠Protocols

OAuth 2.0 · OpenID Connect · SAML 2.0 · WebAuthn / FIDO2 · TOTP / MFA · SCIM 2.0 · Device Authorization (RFC 8628)

⁠Identity

Multi-tenancy via realms · Organizations (B2B) · RBAC + ABAC · Hierarchical groups · Service accounts + API keys · LDAP federation · External IdP brokering (OIDC + SAML social login) · Magic links · Email + SMS OTP

⁠Adaptive auth

Risk-based step-up · Impossible-travel detection · IP reputation · Device fingerprinting · Continuous verification · ACR levels (password / MFA / WebAuthn)

⁠Operations

Stateless · Horizontal scaling · Optional Redis (with Sentinel HA) · Prometheus metrics · Structured JSON logs · Health / readiness probes · API versioning · Per-realm theming (Handlebars SSR)

⁠Ecosystem

10 client SDKs: TypeScript core · React · Next.js · Angular · Vue · Android · iOS · CLI · Python · Go · Java

Migration importers for Auth0 and Keycloak configurations are built in.

⁠Tags

Production deployments should pin a specific version rather than latest.

⁠Required environment variables

Generate strong values with:

openssl rand -hex 32   # for ADMIN_API_KEY and WEBHOOK_SECRET_KEY
openssl rand -hex 16   # for WEBHOOK_ENCRYPTION_SALT

Full reference: see .env.example⁠.

⁠Horizontal scaling

The server is stateless — all state lives in PostgreSQL (and optionally Redis for sessions and cache). Run multiple instances behind a load balancer:

docker compose up -d --scale app=3

For production clusters, enable shared session storage:

SESSION_STORE=redis
REDIS_URL=redis://your-redis:6379

⁠Image details

• Base: node:22-alpine · multi-stage build · production deps only
• Runs as the non-root node user (UID 1000)
• Built with --ignore-scripts in the deps stage; Prisma client generated explicitly in the build stage
• Healthcheck: wget -q --spider http://localhost:3000/health/ready every 30s
• Compressed image size: ~325 MB

⁠Documentation, source, support

• Source code: https://github.com/idenplane/idenplane⁠
• Issues: https://github.com/idenplane/idenplane/issues⁠
• Discussions: https://github.com/idenplane/idenplane/discussions⁠
• Security reports: see SECURITY.md⁠ — please do not file security issues publicly

⁠License

Idenplane is released under the GNU Affero General Public License v3.0 (AGPL-3.0). You're free to use, modify, and run it; running a modified network service requires offering source to its users.

For organizations that need to embed Idenplane in a proprietary product, a commercial license is available — contact [email protected]⁠.

Full license⁠