Open Source IAM

Geonosis Identity's New Planet.

IAM server written in Rust. OIDC 1.0 + OAuth 2.1 compliant, with a graph‑DSL flow engine, WASM plugin system, and a built‑in admin UI.

Get Started View Source

Features

Built for the demands
of modern identity.

OIDC 1.0 + OAuth 2.1

protocol

Full protocol compliance out of the box. Authorization Code with PKCE, Client Credentials, Device Authorization, Token Exchange, and Dynamic Client Registration.

Client /authorize Flow Engine Token

Rust Performance

Zero-cost abstractions, no GC pauses, predictable latency. Starts in milliseconds, idles at single-digit MB.

Geonosis ~5 MB

Keycloak ~512 MB

Ory Hydra ~30 MB

Flow Engine

Define authentication and registration flows with a graph-based DSL. No XML configs, no code needed.

start → identify
identify → challenge_password
challenge_password → mfa_check
mfa_check → grant

WASM Plugins

Extend every hook with WebAssembly components. Write plugins in Rust, Go, Python — anything that compiles to WASM.

fn on_authenticate(
  ctx: &Context
) -> Result<Action> {
  // your logic here
}

Admin UI

Built-in reactive admin dashboard powered by Leptos. Manage realms, clients, users, and flows — no separate deployment.

admin / realms / master

Users 24

Clients 8

Flows 3

Kubernetes Native

deploy

Single static binary. Helm chart included. Health checks, graceful shutdown, and structured logging built in.

$ helm install geonosis oci://ghcr.io/hosnian-prime/charts/geonosis \
--set replicaCount=3 \
--set storage.type=postgres

Audit Trail

Every authentication event is logged. Structured JSON output, ready for your SIEM pipeline.

{"event":"login","realm":"master",
"user":"ada@master.test",
"result":"success","ts":"..."}

Architecture

How it all connects.

A single binary that handles discovery, authentication flows, token issuance, and admin — no sidecars, no microservice sprawl.

external Client App

geonosis-server

Protocol OIDC / OAuth

Engine Flow DSL

Plugins WASM SPI

Realm Multi-tenant

Admin Leptos UI

storage Postgres + Redis cache

external Client App

geonosis-server

Protocol OIDC

Engine Flow DSL

Plugins WASM

Realm Multi-tenant

Admin Leptos UI

storage Postgres + Redis cache

Federation

SAML 2.0 IdP, LDAP directory sync, and external OIDC provider brokering — all pluggable per realm.

Quickstart

Running in
under a minute.

One command gets you a fully provisioned identity server with a demo realm, test users, and an OIDC client — ready for integration testing.

Demo credentials

admin admin@master.test / admin-pw

user ada@master.test / ada-pw

client master-web

# Start Geonosis + Postgres

$ make quickstart

# Verify discovery endpoint

$ curl -s http://localhost:8080/realms/master/.well-known/openid-configuration | jq .issuer

"http://localhost:8080/realms/master"

Compare

How Geonosis stacks up.

Feature	Geonosis	Keycloak	Auth0	Ory Hydra
Language	Rust	Java	— (SaaS)	Go
Memory (idle)	~5 MB	~512 MB	—	~30 MB
WASM Plugins
OIDC / OAuth
SAML IdP
LDAP Federation
Flow Engine	Graph DSL	XML / GUI	Rules	—
Admin UI	Built-in	Standalone	Dashboard	—
Self-hosted
License	Apache 2.0	Apache 2.0	Proprietary	Apache 2.0

Who it's for

Built for builders.

Startups

Fast integration. Open source. No vendor lock-in.

Enterprise

SAML, LDAP federation. Audit trail. Compliance-ready.

Platform Engineers

Kubernetes-native. Helm chart. Extend everything with WASM.

Roadmap

The trajectory.

v0.1 GA Foundation shipped

Core protocols, flow engine, admin UI, storage backends, CLI.

v0.2 Scale

Multi-tenancy, advanced federation, plugin marketplace.

v0.3 Modern Auth

Passkeys / WebAuthn, adaptive MFA, analytics dashboard.

v1.0 Production

Battle-tested stability, enterprise support, SLA guarantees.