Project · Identity and access
IdPAM: identity and access across applications
Identity Provider and Access Manager is an identity-provider and access-management prototype: it centralizes authentication and separates who a person is from what each of their credentials may do. It began as a personal exploration and is being recovered as a reproducible PoC, not a finished product.
- Original author
- Facundo Beltramo
- Origin
- Recovered personal project
Status and resources
Recovered PoC
Technical analysis
Read the complete article- Interactive demo
- Not available yet
Shared access, clear decisions per application
Across a set of applications, solving login in each one is not enough: access to each resource also needs a decision. IdPAM explored a shared foundation for those decisions by separating identity, credential, role, and permission. An identity could own independent credentials with their own roles; its engine evaluated verbs and hierarchical targets with default deny.
From login to policy decision
Authentication mechanisms were modeled as extensible strategies. After authentication, an application asked whether the credential could act on a resource; IdPAM returned allow or deny and the consumer enforced the result. The contract was validated with Postman and a non-production consumer prototype.
What is verified
The recovery runs the real application with synthetic identities, disposable storage, and a configurable reset. It exercises password, temporary token, SSH Ed25519 proof of possession, and a federated lab using Dex, OpenLDAP, LDAPS, and OIDC. This is evidence of a reproducible PoC, not a security audit.
Boundaries and evolution
It never reached a release or production. Explicit deny rules, regex, direct Bearer authentication per request, and persistent audit logs are future work rather than historical features. The sanitized source is now public; the demo remains pending until isolation, sessions, images, and negative tests are closed.