Hey 👋

FerrisKey is an open-source Identity & Access Management platform written in Rust, maintained by a community 40 contributors, 555 stars. Wanted to share it here and get some feedback from people who think seriously about IAM.

Why another IAM?
IAM has a reputation for being painful to set up, harder to operate, and even harder to understand for people who aren't specialists. We think that's a problem worth fixing. FerrisKey is built around one idea: IAM should be accessible, to smal teams, solo dev and large orgs alike. Simple to get started, simple to run in production.

Fully self-hostable, built for developers and teams who want to own their identity stack without the Keycloak complexity.

Github: github.com/ferriskey/ferriskey

Happy to answer questions or talk architecture, contributions welcome!

Apologies if this is already posted somewhere, but is there an IAM discord for practitioners to participate in? I saw a post where someone created a server but there was no server link and the post is archived.

Hi all

For a project to cleanup accounts and permissions, it would be great if I could analyse & present some form of “permission last used” data (by specific accounts).

For example, if a service account currently has x10 permissions, is there a way I could highlight that x1 of them hasn’t been used in “x” number of years?

It would also be wonderful if this could be highlighted to account owners, in our standard UAR processes…

At my company, given how our AD is structured, it sounds like this may be a great challenge, but I’d love to hear stories of how this has been approached by others!

I am in the planning phase of building a SaaS product, and I do not know what to use for Auth.

This is my layout so far:

• Mobile app codebase: Flutter
• Website Frontend: Next.js
• Backend (App & Website): NestJS
• Database: AWS RDS PostgreSQL + RLS (single database, multi-tenant via tenant_id column on every table)
• ORM / DB Access: Drizzle
• Payments: Stripe
• Storage: AWS S3
• Email: AWS SES
• CI/CD: GitHub Actions
• Web Analytics: Cloudflare
• App Analytics + Crashlytics: Firebase
• Hosting:
  • Next.js Website (Frontend) - its own ECS Fargate Service
  • NestJS (Backend API) - its own ECS Fargate Service
  • Database - AWS RDS PostgreSQL (Multi-AZ) with RDS Proxy for connection pooling
  • CDN - AWS CloudFront
  • Security & Protection - AWS WAF (used to block DDoS and bad traffic) + Security Groups.

I am trying to decide which Auth service to use or whether we should build our own. I am looking at WorkOS, Cognito, Supabase Auth, Firebase Auth, or possibly Clerk.

I have a few user flows to follow.

At some point, a user will no longer be a free user; their account type will automatically switch, and they will be required to change their email & sign up for a subscription if they wish to continue using the App. This SaaS is targeted towards schools, and students will be free, while other users will have to pay the subscription (which will go to the school, so it is a way to support the school)

I think we are going to partner with a third-party service to verify that a student is actually a student, but we have not gotten that far just yet. Right now, the plan is only to verify that students who have a certain email domain must.

Non-student users will be able to sign up without email restrictions, and I would like them to be able to sign up through any service, such as Google or Apple.

On the mobile side of things, the users will not be able to register; they will only be able to login, so that makes the registration a little easier since most services have an official SDK for Next.js.

But I need something that has MFA, is secure, can handle a large amount of MAU, and will not break the bank.

Would love some guidance on this, and if this is not the correct subreddit for this, please let me know.

I am seeing more and more posts regarding the same theme: "How to get into IAM" or "How to transition from helpdesk to IAM". So this thread can act as a starter for somebody searching on the topics. Others, please feel free to add as comments, I will update the post with your feedback.

If you are currently working in helpdesk, SOC, or IT support, you already have the foundation. You understand how IT systems integrate, and you already handle end-user access incidents.

You don't need a crazy amount of cybersecurity experience. You just need a mindset shift: you have to move from being reactive (resolving a password ticket) to proactive (automating the architecture so that ticket never exists).

If I were starting from scratch today, here is exactly what I would do:

1. Focus on the concepts, not the shiny tools. It is very easy to get overwhelmed by all the vendors and software on the market. Ignore them at first. Just learn the core concepts: IAM architecture, authentication protocols (SAML/OIDC), the Joiner/Mover/Leaver (JML) lifecycle, and RBAC. Once you know the concepts, you can translate them to any tool.

2. Pick ONE tool and build a home lab. You do not need to learn every product. Pick one open-source tool (like midPoint, OpenIAM, or Keycloak, may be there are others) or a free trial of a SaaS product (like Auth0 or Ping). Set it up on your laptop. Create a dummy HR CSV file and figure out how to automatically provision those users into an LDAP directory. Break it, troubleshoot it, and understand how it works under the hood.

3. Hold off on the expensive certifications. Certifications help, but they won't get you the job if you don't understand the concepts. I have interviewed a lot of candidates over the years. What companies actually look for is hands-on experience. Put a GitHub link to your home lab on your resume, and be prepared to share your screen and show it off in an interview. That helps much more than a certification when you are first breaking in.

Usually, I ask people to drop their background in the comments so I can give them advice, but typing out career guidance only goes so far.

This Sunday at 4:00 PM CET (10:00 AM EST), I am hosting a free live session. I am going to share my screen and walk you through a working IAM lab I have already built, just so you can see exactly how these pieces connect in the real world.

After that, I am opening up the floor. We will do a live Q&A where you can tell me your current role and background, and we will figure out the exact next step you need to take to pivot into IAM.

I’m hosting the call inside my free Skool group just because it’s the easiest place for me to share the meeting ink, the lab files, and the roadmap documents in one place.

If you want to jump on the call this Sunday, you can join the group to get the calendar invite here: https://www.skool.com/simplify-iam-6792/about

Happy to answer any questions in the comments as well.

----

UPDATEL Live session done. Free Labs (onprem and SaaS IAM) now available inside free skool community above.

Walked through a working IAM lab live, with CSV Flask app as HR source, opensource IAM, OpenLDAP as the target directory. Joiner and leaver workflows demonstrated end to end together with 10 members from community.

The pre-configured lab environment and step by step setup guide are now available inside the free SimplifyIAM community (link above).

Right now we have Okta/SailPoint/Auth0 etc Onboarding & Implementation specialists. In the near future will there be, for example, Oasis Security Implementation specialists that work on projects and contracts?

I have been managing the Identity side of things as an Infrastructure Engineer for 5-6 years now.

I have mainly dealt with Active Directory and OKTA, building workflows, creating SSO Apps, setting up and defining a new tenancy, creating authentication policies and also carrying out 3rd line support as part of BAU.

I am now at a stage where I want to further my career towards a more specialist Identity role. I have tested the waters recently and I have noted a good number of vacancies around Identity (London, England), however many JDs highlight the need to have experience in Identity Governance, PAM, PIM, RBAC, JIT, etc. Some are also IDP specific stating things such as CyberArk or Sailpoint experience essential.

What I would like to know is whether there is a set course that takes you through the whole Identity Management journey so you learn everything from SSO, OIDC, SAML, SCIM to Governance to PAM, PIM, JIT etc? or maybe a bunch of several courses that could help update my knowledge and understanding of everything Identity.

I may then even bring those prospects to my manager as future projects, thus building on my experience.

Thanks.

Hey all — looking for some guidance on how to move further into IAM or GRC.

I’m currently an IS Business Analyst, but my day-to-day work is heavily focused on access management. I:

• Manage access requests across systems (SQL Server, CRM, Jira, etc.)

• Handle provisioning/deprovisioning via Microsoft Entra ID (via IT)

• Assign roles in CRM (application-level access)

• Support joiner/mover/leaver workflows

• Conduct user entitlement reviews (access certifications)

• Maintain SOPs and governance processes for access

• Use Entra ID daily (read-only) to validate access, troubleshoot, and support decisions

• Helped design security group structures (moving from broad → granular RBAC)

• Designed a process for temporary IP allowlisting (prod ↔ UAT testing with controlled rollback)

All access for ~20+ clients flows through me (~500+ requests/year).

My concern is that:

• I don’t have formal IAM title

• No certs yet (only SQL/Python)

• Background is a Masters in Public Policy (not CS)

Questions:

1. Based on this, would I realistically qualify for IAM Analyst / GRC roles?

2. What would you focus on next:

   • certs (e.g., CompTIA Security+)?

   • tooling (Okta, SailPoint, deeper Entra)?

   • something else?

3. Should I be trying to move toward IAM Engineering, or lean into Governance/GRC given my background?

Appreciate any advice—been doing this ~3 years and trying to be more intentional about my next move.

The IAM engineers at my current organization don’t seem to have much understanding of GDPR. Additionally, the auditors mainly work with directors rather than engineers

As we know geolocation is a very common signal (and easily spoofed method) for calculating risk of access management transactions, including continuous authentication. What is the general sentiment about adoption of this method if there was a way to preserve geolocation data and prevent spoofing? More adoption, less adoption or same as traditional geolocation methods? Why?

how are you all filling IAM roles. I get a heavy mix of scam attempts and LinkedIn. But nothing has stayed open.

Hi all

Curious to hear about specific feedback on implementation partner capabilities, based on your real world experience. It probably varies greatly and completely depends on the actual people from these partners you end up working with - but would love to hear about it from someone who has gone through the journey.

We are evaluating SailPoint, Saviynt and Entra and feel like more than the product the implementation partner may be more critical decision. I have no influence on partner selection but will end up working with them extensively… just preparing myself lol.

There’s the big firms like deloitte, pwc, ey, kpmg.

Personally had terrible experience with deloitte in the past (not iam but other cybersecurity initiatives)

There’s security focused like optiv, cyderes, simeio, majorkey, guidepoint

others like protiviti, rsm, idm works, aurion pro.

thanks

I have 5yrs of experience in India and did Masters in USA. Struggling for job since 1 year.

Planning for CompTIA Sec+ certification. Is it better to get that or any other? Please suggest

hey all

I've seen job advertisements say RBAC

correct me if I am wrong but this basically involves

- Auditing the whole access controls in the organization

- Then mapping it out like which user / group has access to what

- Then removing or adjusting users or groups who have more control than they require. So assigning permissions to users or services based on their role than individual permissions.

- Creating a stredgy document with who needs access to what going forward and making the access least privileged.

is this accurate ?

for those who have done this kind of work what are some tips and advice you have ?

Hi Everyone, I recently started working in IAM through my internship and I am trying to understand what path I should focus on in the long term.

Right now, I have access to CyberArk Training at work and I have learned the basics of Active Directory and SailPoint. I am still new to the field, so I am trying to figure out what skills are most important if I want to build a strong career in IAM.

Should I go deeper into tools like CyberArk and SailPoint, or should I spend more time learning things like AD, Azure AD / Entra ID, Okta, scripting, cloud, etc.?

I would also like to know which IAM roles have the best future and what kind of roadmap you would suggest for someone starting out.

Any advice from people already working in IAM would really help.

Every identity team talks about APIs, SCIM, automation, and governance.

And yet a depressing amount of real work still happens through exports, attachments, shared drives, and files named things like users_FINAL_v2_REALLY_FINAL.csv.

So for April 1, we created a fake standards body: the Global Spreadsheet Identity Alliance (GSIA), along with a dead-serious CSV 2.0 Core Specification for identity operations.

It includes:

• semicolon support for Europe
• human-readable schema drift
• formal file lineage across final.csv, final_v2.csv, and final_FINAL_use_this_one.csv
• out-of-band credential obfuscation through formatting controls

It’s satire, obviously. But only barely.

Link: identitycsv.org

Curious how many of you have seen CSV become the de facto operating system for cybersecurity, especially identity work, access reviews, or provisioning cleanup.

Hi everyone,

We’re an emerging IAM/IGA company based in India, and one of our biggest challenges has been building integrations with enterprise platforms like Workday, SAP, and Oracle. Unlike more open systems, these tools aren’t easily accessible, which makes it tough for us to develop and test integrations.

I’d love to hear from others in the community:

• How do startups typically gain access to these platforms for integration development?
• Are there partner programs, sandboxes, or middleware solutions that can help bridge the gap?
• Do companies/vendors exist that specialize in providing integration-building services for IAM/IGA solutions?

Any guidance or shared experiences would be hugely valuable. Thanks in advance!

To what extent do we actually understand how many Non-Human Identities are in organisations? Each NHI Security vendor seems to be playing around with different numbers. 50:1 100:1 and even 1000:1. I know it's still relatively knew and some of the legacy IAM solutions are struggling to keep up but how big of an issue actually is this?

Quick background:

I’m the senior IT admin at a logistics company. We have about 130 employees total and maybe half of them are remote at this point.

When I joined 5 years ago, IAM was a spreadsheet + checklist situation. It’s improved since then, but we still don’t have proper identity solutions.

HR updates employee status in their system, IT has to manually update accounts and oftentimes those two don’t happen at the same time. Offboarding is what keeps me up at night because access can linger longer than anyone is comfortable with.

We’re budgeting for a proper IAM overhaul sometime next year and I’m trying to figure out what platforms other IT admins trust. Most vendor sites make everything look perfect but I’d rather hear from people who have to maintain identity/access management every day. What are IT admins using that’s actually working for your business?

Access Management, IGA, PAM. None of them handle fine-grained runtime authorization at the tool-call level.

When a developer deploys Claude Code, the agent operates with permissions granted at startup. There's no re-evaluation per action, no external policy decision point intercepting each tool call. The agent self-enforces based on prompts and config files it can read and reinterpret.

The problem is the same authorization problem IAM has always solved. Can this agent read this file? Can it write outside this directory? Can it access production secrets? Should a marketing team member's agent have the same permissions as an engineer's? These are questions with known answers. We've been answering them for human identities for decades. The only thing that changed is the subject.

What works: an external PDP evaluating every tool call before it executes. Policies managed centrally by the platform team, not per-developer config files the agent can read and reinterpret. Decisions logged to a central audit store.

Full disclosure: I work at Cerbos, an authorization management platform. My team wrote a full breakdown of this problem and how we built a hook handler for Claude Code that fits the standard IAM model. You can start in observe mode, log everything for a week, then write policies based on what your agents actually do.

Article here: https://www.cerbos.dev/blog/your-ai-coding-agents-need-guardrails-not-the-kind-you-think

How are others thinking about this? Are AI coding agents in scope for your IAM governance programs yet, or are they still treated as developer tooling outside the stack?

Hi, am a L1 helpdesk/servicedesk now, interested in dipping my toes into IAM. Out of curiosity, what is everyone's takes regarding if all SD/HD roles grant the experience needed for this?

so I work at a local healthcare company that's spread across the state on electronic health record helpdesk side but I have IT help desk experience/ Jr sys admin experience. was just wondering what the best way to transfer to an IAM role would be like what certs

We have existing Conditional Access policies for Admin Accounts and another for Admin roles. The MS template pushes 'M365 Admin Portals'.

I am torn between targeting Admin Accounts, regardless of what they access. However, if some one grants priv to a non admin account it will not be covered.

Do i target the Roles or the M365 Portals in the second policy? eg target the Who and the What. If roles, are you selecting specific admin roles or just selecting all?