SSO, MFA, access control — plus a built-in task engine, event-driven automation, and scriptable login flows. Everything your IAM should do, without the bolt-on tools.
Scripts, not plugins
Write real Go code — modify tokens, enforce policies, sync users. No plugin SDKs, no webhook chains, no vendor lock-in.
Events, not cron jobs
Login, group change, access revoked — any event triggers any action. Built-in retries, delivery log, zero glue code.
Requests, not tickets
Users request temporary access. It gets approved, granted, and auto-revoked — without anyone remembering to clean up.
JustIAM has a built-in Go scripting engine. Write real code that runs inside the identity provider — modify tokens at render time, enforce MFA policies per-user, sync users to external systems on a schedule. No sidecars, no webhook chains, no external runtimes.
// Inject user attributes + deny outside hours
func Run(ctx context.Context, claims Claims) Claims {
user := idp.GetUser(ctx, claims.Sub)
// Copy custom attributes into the token
for k, v := range user.Attributes {
claims.Extra[k] = v
}
// Block access outside business hours
hour := time.Now().Hour()
if hour < 8 || hour >= 20 {
claims.Deny = "Outside business hours"
}
return claims
}JustIAM emits events for logins, group changes, access grants, token revocations — everything. Connect conditions and actions: a webhook, Slack message, email, or a custom script. Full delivery history so you know what ran and when.
Users request access to groups for a defined period. Approvers review and approve. Access is granted automatically — and revoked the moment it expires. No manual cleanup. No forgotten permissions. No Jira ticket required.
Some apps don't support OIDC or SAML. JustIAM's forward-auth proxy sits in front of any HTTP application — authenticating users, injecting identity headers, and managing downstream session cookies. When you revoke access, JustIAM clears the app's cookies too.
App Presets come with pre-filled OIDC redirect URIs, scopes, and claim mappings for popular tools like ArgoCD, Grafana, GitLab, Vault, and more. Select a preset, adjust if needed, and your app is ready for SSO.
Users belong to groups. Groups get access to applications. Each group × app pair carries a
custom claim value —
admin,
viewer,
a team slug. JustIAM injects it into the token automatically. No role hierarchies, no permission matrices.
Other identity providers give you authentication. JustIAM gives you a platform.
Most IdPs need external tools for anything beyond login. JustIAM has a scripting engine, task scheduler, and event system built in. No sidecars, no webhook chains, no third-party orchestrators.
Every resource — users, groups, apps, mappings, roles, event actions — has a Terraform resource. GitOps your entire identity infrastructure from day one.
Self-service access requests with auto-expiry, approval workflows, and full audit trail. No external ticketing system. No stale permissions.
Write Go code, not YAML or JSON policies. Modify tokens at render time, enforce MFA dynamically, sync to any external system. Full language, full power.
Your data stays in your infrastructure. One Docker Compose file or Kubernetes manifest. No phone-home, no usage reporting, no cloud dependency.
Groups-based access, not RBAC spreadsheets. Clean UI, comprehensive API. Enterprise-grade features without the enterprise setup time.
Most identity providers give you login. Everything else requires external tools, paid add-ons, or custom glue code.
| Capability | Typical IdP | JustIAM |
|---|---|---|
| OIDC / SAML SSO | ✓ | ✓ |
| MFA (TOTP, Passkeys) | ✓ | ✓ |
| Forward-auth proxy with session cleanup | — or paid add-on | ✓ built-in |
| Event-driven automation (webhooks, Slack, scripts) | — external webhook consumer | ✓ built-in |
| Scriptable token customization (real code, not DSL) | — or limited mappers | ✓ full Go stdlib |
| Scheduled user/group sync (LDAP, Google, GitHub) | — external cron + scripts | ✓ built-in task engine |
| Self-service access requests with auto-expiry | — or separate PAM tool | ✓ built-in |
| Full Terraform provider (all resources) | partial or community | ✓ official, complete |
| Self-hosted, single binary, Docker Compose ready | heavy / Java / cloud-only | ✓ ~50 MB Go binary |
| Multi-tenant control plane | — or enterprise tier | ✓ included |
Protocol & integration support
The official Terraform provider lets you manage every JustIAM resource — users, groups, applications, mappings, roles, event actions — as infrastructure.
resource "justiam_application" "argocd" {
name = "argocd"
type = "web"
redirect_uris = ["https://argo/auth/callback"]
mfa_policy = "required"
claim_mappings = [{
claim = "groups"
value = "$${roles}"
}]
}resource "justiam_group_app_mapping" "eng" {
group_id = justiam_group.engineering.id
application_id = justiam_application.argocd.id
role_value = "admin"
}
resource "justiam_group_app_mapping" "ops" {
group_id = justiam_group.ops.id
application_id = justiam_application.argocd.id
role_value = "viewer"
}Need to manage multiple JustIAM tenants? The Control Plane gives you a single dashboard to provision tenants, allocate licenses, manage worker infrastructure, and monitor everything from one place.
News, deep dives, and feature walkthroughs.
May 2026
Why every team needs an IDP, and why JustIAM is built for the way modern teams actually work.
May 2026
Forward-auth, cookie cleanup, and session revocation for apps that don't speak OIDC.
May 2026
Use tasks and event triggers to keep external systems in sync with JustIAM — automatically.
April 2026
Self-service temporary access with automatic expiry. No tickets, no forgotten permissions.
One compose file. No external dependencies. Full SSO in your infrastructure today.
$ git clone https://github.com/just-corp/JustIAM.git
$ cd JustIAM && cp .env.example .env
$ docker compose up --build -d
✓ JustIAM running at http://localhost:3000