OIAF Documentation¶
Risk-based access control and MFA orchestration for hybrid identity.
OIAF (Open Identity Access Firewall) is an open-source identity access firewall that evaluates authentication risk and enforces adaptive MFA across Linux, Windows, RADIUS, LDAP, web apps, cloud identity providers, and machine identities.
Sections¶
| Section | Description |
|---|---|
| Quickstart | Get running in minutes |
| Architecture | System design and components |
| Security | Threat model, secure defaults, credential handling |
| Adapters | Integration adapters for protocols and platforms |
| Deployment | Docker Compose, production, air-gapped |
| Operations | Backup, monitoring, disaster recovery |
| Policies | Policy format, operators, examples |
| Contributing | Dev setup, coding standards, RFC process |
| API Reference | OpenAPI 3.0 spec |
Key Concepts¶
- Access Request — A structured description of who is accessing what, how, and from where.
- Policy Engine — Evaluates declarative JSON policies against access requests.
- Risk Engine — Scores contextual risk (geo, protocol, device, privilege) on a 0–100 scale.
- MFA Orchestrator — Issues and verifies TOTP and push challenges.
- Adapters — Protocol-specific agents (RADIUS, LDAP, PAM, Windows) that call the Decision API.
- Audit Log — Hash-chained, tamper-evident event log.
Status¶
OIAF is experimental / pre-release. Interfaces and data formats may change without notice. Do not deploy in production without independent security review.