SSO, MFA, access control — plus a built-in task engine, event-driven automation, and scriptable login flows. Everything your IAM should do, without the bolt-on tools.
Scripts, not plugins
Write real Go code — modify tokens, enforce policies, sync users. No plugin SDKs, no webhook chains, no vendor lock-in.
Events, not cron jobs
Login, group change, access revoked — any event triggers any action. Built-in retries, delivery log, zero glue code.
Requests, not tickets
Users request temporary access. It gets approved, granted, and auto-revoked — without anyone remembering to clean up.
JustIAM has a built-in Go scripting engine. Write real code that runs inside the identity provider — modify tokens at render time, enforce MFA policies per-user, sync users to external systems on a schedule. No sidecars, no webhook chains, no external runtimes.
// Inject user attributes + deny outside hours
func Run(ctx context.Context, claims Claims) Claims {
user := idp.GetUser(ctx, claims.Sub)
// Copy custom attributes into the token
for k, v := range user.Attributes {
claims.Extra[k] = v
}
// Block access outside business hours
hour := time.Now().Hour()
if hour < 8 || hour >= 20 {
claims.Deny = "Outside business hours"
}
return claims
}JustIAM emits events for logins, group changes, access grants, token revocations — everything. Connect conditions and actions: a webhook, Slack message, email, or a custom script. Full delivery history so you know what ran and when.
Users request access to groups for a defined period. Approvers review and approve. Access is granted automatically — and revoked the moment it expires. No manual cleanup. No forgotten permissions. No Jira ticket required.
App Presets come with pre-filled OIDC redirect URIs, scopes, and claim mappings for popular tools like ArgoCD, Grafana, GitLab, Vault, and more. Select a preset, adjust if needed, and your app is ready for SSO.
Users belong to groups. Groups get access to applications. Each group × app pair carries a
custom claim value —
admin,
viewer,
a team slug. JustIAM injects it into the token automatically. No role hierarchies, no permission matrices.
Other identity providers give you authentication. JustIAM gives you a platform.
Most IdPs need external tools for anything beyond login. JustIAM has a scripting engine, task scheduler, and event system built in. No sidecars, no webhook chains, no third-party orchestrators.
Every resource — users, groups, apps, mappings, roles, event actions — has a Terraform resource. GitOps your entire identity infrastructure from day one.
Self-service access requests with auto-expiry, approval workflows, and full audit trail. No external ticketing system. No stale permissions.
Write Go code, not YAML or JSON policies. Modify tokens at render time, enforce MFA dynamically, sync to any external system. Full language, full power.
Your data stays in your infrastructure. One Docker Compose file or Kubernetes manifest. No phone-home, no usage reporting, no cloud dependency.
Groups-based access, not RBAC spreadsheets. Clean UI, comprehensive API. Enterprise-grade features without the enterprise setup time.
Protocol & integration support
The official Terraform provider lets you manage every JustIAM resource — users, groups, applications, mappings, roles, event actions — as infrastructure.
resource "justiam_application" "argocd" {
name = "argocd"
type = "web"
redirect_uris = ["https://argo/auth/callback"]
mfa_policy = "required"
claim_mappings = [{
claim = "groups"
value = "$${roles}"
}]
}resource "justiam_group_app_mapping" "eng" {
group_id = justiam_group.engineering.id
application_id = justiam_application.argocd.id
role_value = "admin"
}
resource "justiam_group_app_mapping" "ops" {
group_id = justiam_group.ops.id
application_id = justiam_application.argocd.id
role_value = "viewer"
}Need to manage multiple JustIAM tenants? The Control Plane gives you a single dashboard to provision tenants, allocate licenses, manage worker infrastructure, and monitor everything from one place.
News, deep dives, and feature walkthroughs.
May 2026
How JustIAM's built-in Go scripting engine lets you sync users, modify tokens, and automate workflows without external tools.
May 2026
Replace cron jobs and webhook chains with built-in event actions that fire on login, group change, or access revocation.
April 2026
Self-service temporary access with automatic expiry. No tickets, no forgotten permissions, no manual revocation.
One compose file. No external dependencies. Full SSO in your infrastructure today.
$ git clone https://github.com/justiam/justiam
$ docker compose up -d
✓ JustIAM running at http://localhost:8080