Multi-tenant OAuth2 / OIDC server with MFA, SAML federation, passkeys, and full SCIM provisioning. Self-host or deploy to cloud — you own the data.
# Start your CIAM stack in one command docker compose up -d # OIDC Discovery https://dev.auth.platform.com/.well-known/openid-configuration # Token & Authorization endpoints https://dev.auth.platform.com/oauth2/token https://dev.auth.platform.com/oauth2/authorize # Per-tenant JWKS (auto-rotated RSA-2048) https://{tenant}.auth.platform.com/oauth2/jwks # Admin REST API https://dev.auth.platform.com/admin/tenants
Integrates with your existing stack
From a simple login page to enterprise federation — CIAM Platform has it covered out of the box.
Full Spring Authorization Server. Authorization Code + PKCE, Client Credentials, Device Flow, Refresh Tokens, Introspection.
Subdomain or X-Tenant-ID header routing. Full data isolation with PostgreSQL Row-Level Security.
TOTP (RFC 6238), Email OTP, SMS OTP, and WebAuthn Passkeys. Per-tenant MFA policy enforcement.
Act as SAML IdP or SP. Integrate with Okta, Azure AD, and enterprise IdPs via metadata import.
Auto-generated RSA-2048 key pairs per tenant. Redis-cached with lazy rotation. Unique JWK Set per tenant.
Valkey-backed brute-force protection (5 attempts / 15-min window, 30-min lockout) plus risk evaluation.
Hierarchical organizations, memberships, and SCIM 2.0 user provisioning for enterprise directory sync.
Pluggable email and SMS providers. Send MFA codes, invitations, and password-reset links.
Full-featured React admin dashboard. Every operation available via REST API for programmatic management.
Every request passes through TenantContextFilter. Tenant is resolved from subdomain, header, or default slug — giving each customer a fully isolated identity store.
Credentials verified by CiamUserDetailsService using Argon2id. Rate-limiting checked atomically via Redis.
If tenant policy requires MFA, session is stashed and user completes a TOTP, passkey, SMS, or email challenge before the OAuth2 flow resumes.
JWTs signed with the tenant's RSA key pair. Tokens carry tenant_id, org_id, roles, and permissions — ready to consume in any microservice.
"Setting up a multi-tenant OIDC provider used to take weeks. CIAM Platform had us live in a day — including MFA and per-tenant JWT signing."
"The rate-limiting and breached-password detection was a surprise. We didn't have to build any of that — it's just there, backed by Redis."
"Passkey support and SAML federation in the same open-source package? We evaluated four vendors before finding this."
One docker compose up command and your full CIAM stack is running.