Risk-based access control and MFA orchestration for hybrid identity.
Warning
Experimental / pre-release (current tag: v0.2.1-security). OIAF is pre-release
software. Interfaces, data formats, and behavior may change without notice. Do not
deploy in production without independent security review. The v0.2.x tags mark
security fixes and merged MFA work, not a stability promise.
Note
OIAF is an independent open-source project. It is not affiliated with or endorsed by any commercial identity-security vendor.
OIAF is an open-source identity access firewall that evaluates authentication risk and enforces adaptive MFA across Linux, Windows, RADIUS, LDAP, web apps, cloud identity providers, and machine identities.
Nothing in production — yet. OIAF targets the same problem space as commercial identity-security platforms (Silverfort, CyberArk, Delinea, Duo, Okta, Microsoft Entra ID Protection and others), but it is pre-release: the PAM enforcement path is real and packaged, TOTP/push MFA are functional, WebAuthn ceremonies are implemented and tested (29 test functions across the MFA and API layers — against a software authenticator, not a hardware key), and the Okta adapter is implemented and offline-tested, while the remaining cloud-IdP adapters (Entra ID, Duo, generic webhook) are design-stage skeletons. Storage is still in-memory only, so nothing survives a restart — including the audit hash chain, which is the limitation that gates DC monitoring and the identity graph. For an honest, capability-by-capability comparison against the commercial market — including what each maturity level does and does not replace for you — see OIAF vs commercial identity security (docs/comparison.md).
+-----------+
| Adapters | (Linux PAM, RADIUS, LDAP, Web/OIDC, Cloud IdP, Machine)
+-----+-----+
|
v
+-------------------+
| Decision API | (evaluate, challenge, verify)
+---------+---------+
|
+---------+----------+
| |
v v
+---------------+ +---------------+
| Policy Engine | | Risk Engine |
+-------+-------+ +-------+-------+
| |
+---------+----------+
|
v
+-------------------+
| MFA Orchestrator | (TOTP, Push, WebAuthn, ...)
+---------+---------+
|
v
+-------------------+
| Audit Store | (hash-chained, tamper-evident)
+-------------------+
git clone https://github.com/Schildkrote/oiaf.git
cd oiaf
make devoiafctlCLI for administration (go build -o oiafctl ./cli/oiafctl— binaries are not committed)- Admin UI
- Policy engine (declarative access policies)
- Risk engine (contextual risk scoring)
- TOTP and push MFA
- WebAuthn/passkey ceremonies (registration + assertion), tested against a software authenticator; hardware-key validation is still an open gate
- Audit logging with hash chain
- Adapter SDK with reference skeletons (RADIUS/LDAP/Entra/Duo/webhook stubs exit 1)
- Okta adapter — System Log ingestion and credential redaction, 91 test functions. Tested offline against recorded fixtures; never against a live Okta tenant
- Storage today: MemoryStore only.
OIAF_DATABASE_URL/ compose Postgres+Redis are not wired into a Postgres backend yet. Note thatconfig.example.yamladvertises astorage.driversetting whichmain.godoes not currently read — the knob is inert until a durable driver lands (roadmap next step 1)
- Authentication monitoring on DCs via official Windows APIs (EvtSubscribe / ETW); no WEF/WEC infrastructure required
- No LSASS injection, no kernel credential interception, no modification of SAM or Kerberos/NTLM protocol implementations
- Inline enforcement via AD response actions (LDAPS) and WFP network filtering; no LSASS-resident code
- No agents required on application servers
See SECURITY.md for vulnerability reporting and the project's security posture. Treat all identity-enforcement components as high-trust and review before deployment.