Identity Platform

One Identity. Every Product.

Central identity, authentication, and authorization infrastructure for your product ecosystem. Built as an independent platform — not owned by any single product.

Quick Start

Prerequisites

• Docker 27+ and Docker Compose
• Python 3.12+ (for local backend dev)

No Node.js toolchain is required: the account UI (login, registration, consent, password flows, dashboard) is rendered by Django templates.

Run with Docker Compose (Recommended)

# Copy env and adjust if needed
cp .env.example .env

# Build and start all services
docker compose up --build -d

# Run migrations (first time only)
docker compose exec api python manage.py migrate

# Create superuser (optional)
docker compose exec api python manage.py createsuperuser

Services:

• Web (login, account, consent): http://localhost:8000/
• API (DRF): http://localhost:8000/api/v1/
• API Docs (OpenAPI/Swagger): http://localhost:8000/api/docs/
• Admin: http://localhost:8000/admin/
• PostgreSQL: localhost:5432
• Redis: localhost:6379

Local Development (Without Docker)

Backend:

cd apps/api
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp ../../.env.example .env  # adjust DATABASE_URL to sqlite:///dev.db for quick start
python manage.py migrate
python manage.py runserver

Architecture Overview

┌─────────────────────────────────────────────────────────────┐
│                      IDENTITY PLATFORM                       │
│  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐        │
│  │  Users  │  │   Auth  │  │  Org    │  │ Session │  ...   │
│  └────┬────┘  └────┬────┘  └────┬────┘  └────┬────┘        │
│       └────────────┴────────────┴────────────┘              │
│                    PRIVATE KEY (RS256)                       │
└────────────────────────────┬────────────────────────────────┘
                             │
              ┌──────────────┼──────────────┐
              ▼              ▼              ▼
         ┌─────────┐   ┌─────────┐   ┌─────────┐
         │Bermooda │   │ Hamsoo  │   │  Future │
         │  (ERP)  │   │ (Network)│  │  Apps   │
         └─────────┘   └─────────┘   └─────────┘
              ▲              ▲              ▲
              │   PUBLIC KEY (verify only)  │
              └──────────────┴──────────────┘

Data Ownership Boundary:

Data	Owner
User ID (UUID)	Identity
Email & Phone	Identity
Authentication & Sessions	Identity
Organizations & Memberships	Identity
Applications & Service Credentials	Identity
Employee & Payroll	Bermooda
Profile & Resume	Hamsoo
Projects & Listings	Product

Key Features

• OAuth 2.0 & OpenID Connect — Standard authorize/token/refresh with PKCE
• Sessions & Devices — Track, revoke remotely, device detection, token rotation
• Organizations & Memberships — Unified org model reusable as company, team, workspace
• Applications & Service Credentials — Per-product client_id/client_secret with explicit ownership
• Security Events & Audit Log — Every login, logout, revocation recorded
• Rate Limiting & Brute-force Protection — Auto-lockout after failed attempts
• RS256 Signing — Private key never leaves platform; products verify with public key
• OIDC Discovery — .well-known/openid-configuration and JWKS endpoints

Project Structure

D:\Projects\UserManager\
├── docker/                    # Dockerfiles
│   └── Dockerfile.api        # Django + Gunicorn
├── docker-compose.yml         # All services
├── .env.example              # Environment template
├── docs/                     # Architecture, API, security, runbook
└── apps/
    └── api/                  # Django 5.2 backend + server-rendered UI
        ├── config/           # Settings, URLs, WSGI/ASGI
        └── apps/             # Modular apps (identity, oauth, sso, ...)

API Endpoints (v1)

Category	Endpoints
Auth	POST /auth/login, POST /auth/refresh, POST /auth/logout
Users	GET /users/me, GET /users/{id}
Organizations	GET /organizations, POST /organizations, GET /organizations/{id}
Memberships	GET /organizations/{id}/memberships, POST /organizations/{id}/memberships
Applications	GET /applications, POST /applications
Sessions	GET /sessions, DELETE /sessions/{id}
Security	GET /events
OIDC	GET /.well-known/openid-configuration, GET /.well-known/jwks.json

Full OpenAPI spec at /api/docs/.

Environment Variables

Key variables (see .env.example for full list):

Variable	Description
DJANGO_SECRET_KEY	Required in production
DATABASE_URL	Postgres connection string
REDIS_URL	Redis connection string
CORS_ALLOWED_ORIGINS	Origins allowed to call the API cross-origin
OIDC_ISSUER	Public base URL; used in iss, discovery and reset links
JWT_SIGNING_KEY	HS256 fallback key (production requires the RS256 pair)

Testing

cd apps/api
python manage.py test

Security Notes

• No "military-grade" claims — real security only
• Private RS256 key stays in Identity Platform
• Products hold only public JWKS
• Sessions and refresh tokens revocable instantly
• Rate limits per-user and per-IP
• Security events immutable audit log

License

Proprietary — Independent business unit within the holding.

---

Built with Django 5.2 + DRF (server-rendered templates), PostgreSQL, Redis.