Access eXtended Identity and Authorization Management
AXIAM is a full vibe-coding experiment — an enterprise-grade, open-source Identity and Access Management (IAM) platform designed from scratch by a human software architect and built entirely through AI-assisted development with Claude Code (Opus 4.6).
The goal: prove that a single architect, collaborating with an AI coding agent, can produce a production-quality IAM system that competes with Keycloak, Okta, and Auth0 — built in Rust for maximum performance, safety, and security.
Every line of code, every test, every commit in this repository has been produced through human-AI pair programming — the architect provides vision, constraints, and review; the AI provides implementation at scale.
While the aim is to build a fully functional IAM system, the deeper goal is to explore the future of software development itself — where human creativity and AI's generative capabilities combine to create software that neither could produce alone. AXIAM is a case study in this new paradigm, pushing the boundaries of what's possible with AI-assisted software engineering.
Note: AXIAM is a work in progress and should not be used in production environments until it reaches a stable release. The project is currently in active development, with core features being implemented and tested.
- Multi-tenant architecture — Organizations contain tenants; tenants provide full data isolation
- RBAC with resource hierarchy — Roles, permissions, groups, and scoped access that cascades through resource trees
- Multiple auth protocols — REST, gRPC, and AMQP for sync and async authorization
- OAuth2 & OpenID Connect — Full authorization server with PKCE, client credentials, and refresh token rotation
- Federation — SAML and OIDC for cross-domain SSO
- PKI & Certificate Management — Hierarchical X.509 certificates, mTLS for IoT devices
- GnuPG Integration — Audit log signing, encrypted data exports, identity attestation
- Webhooks — Real-time event delivery with HMAC-SHA256 signatures
- Comprehensive audit trail — Append-only, tamper-evident logging
| Layer | Technology |
|---|---|
| Language | Rust (edition 2024) |
| Database | SurrealDB (document/graph hybrid) |
| REST API | Actix-Web |
| gRPC | Tonic + Protocol Buffers |
| Message Broker | RabbitMQ (via Lapin) |
| Frontend | React + TypeScript (Vite) |
| Auth Crypto | Argon2id, EdDSA (Ed25519), AES-256-GCM |
| Deployment | Docker, Kubernetes |
Clients (Browser, Mobile, IoT, Services, SDKs)
| | |
REST/HTTPS gRPC/TLS AMQP
| | |
v v v
+--------------------------------------+
| API Gateway Layer |
| Actix-Web | Tonic | Lapin |
+--------------------------------------+
|
+--------------------------------------+
| Service Layer |
| AuthN | AuthZ | Users | Federation |
| Roles | PKI | Audit | OAuth2 |
+--------------------------------------+
|
+--------------------------------------+
| Repository Abstractions |
+--------------------------------------+
|
+--------------------------------------+
| SurrealDB Cluster |
+--------------------------------------+
AXIAM targets compliance with:
- OWASP ASVS — Password requirements, session management, access control
- GDPR — Data export/deletion, consent tracking, audit logs
- ISO 27001 — Access control, cryptography, audit logging
- CyberSecurity Act — Secure by design, vulnerability management
The project follows a structured roadmap of 64 tasks across 19 phases:
| Phase | Focus | Status |
|---|---|---|
| Phase 0 | Project foundation, CI, dev environment | Done |
| Phase 1 | Core domain types & DB repositories | Done |
| Phase 2 | Authentication (password, JWT, MFA) | Done |
| Phase 3 | Authorization engine | Done |
| Phase 4 | REST API | Done |
| Phase 5 | gRPC API | Done |
| Phase 6 | AMQP integration | Done |
| Phase 7 | Audit logging | Done |
| Phase 8 | PKI & certificates | Done |
| Phase 9 | Webhook system | Done |
| Phase 10 | OAuth2 & OIDC | Done |
| Phase 11 | Federation (SAML + OIDC) | Done |
| Phase 12 | Hierarchical Settings & Password Policy | Done |
| Phase 13 | Email Service & Account Flows | Done |
| Phase 14 | Advanced MFA | Done |
| Phase 15 | Admin frontend | Done |
| Phase 16 | Docker & Kubernetes | Done |
| Phase 17 | SDKs (Rust, TS, Python, Java, Kotlin, C#, PHP, Go, Swift, C, C++) | Done |
| Phase 18 | Security audit, compliance, docs | Done |
# Prerequisites: Rust 1.93+, Docker
# Start dev infrastructure (SurrealDB + RabbitMQ)
just dev-up
# Build the project
just build
# Run all tests
just test
# Format + lint + test
just checkaxiam/
├── crates/
│ ├── axiam-core/ # Domain types, traits, error types
│ ├── axiam-db/ # SurrealDB repository implementations
│ ├── axiam-auth/ # Authentication (password, MFA, JWT)
│ ├── axiam-authz/ # Authorization engine (RBAC, hierarchy)
│ ├── axiam-api-rest/ # REST API (Actix-Web)
│ ├── axiam-api-grpc/ # gRPC services (Tonic)
│ ├── axiam-amqp/ # AMQP consumer/producer (Lapin)
│ ├── axiam-oauth2/ # OAuth2 + OIDC provider
│ ├── axiam-federation/ # SAML + OIDC federation
│ ├── axiam-audit/ # Audit logging service
│ ├── axiam-pki/ # Certificate management & GnuPG
│ ├── axiam-email/ # Certificate management & GnuPG
│ └── axiam-server/ # Binary — composes all crates
├── proto/ # Protocol Buffer definitions
├── frontend/ # React admin UI
├── benchmarks/ # Performance/efficiency/security benchmark framework
├── claude_dev/ # Design document & roadmap
├── docker/ # Docker Compose configs
├── k8s/ # Kubernetes manifests
└── sdks/ # SDK contract + OpenAPI spec (the SDKs themselves
# live in ilpanich/axiam-<lang>-sdk repositories)
The eleven client SDKs live in their own repositories. Each one vendors a copy of
sdks/CONTRACT.md (the binding cross-language behavioral contract),
sdks/openapi.json and proto/, which are maintained here:
| Language | Repository | Package |
|---|---|---|
| Rust | axiam-rust-sdk | crates.io |
| TypeScript | axiam-typescript-sdk | npm |
| Python | axiam-python-sdk | PyPI |
| Java | axiam-java-sdk | Maven Central (io.github.ilpanich:axiam-sdk) |
| Kotlin | axiam-kotlin-sdk | Maven Central (io.github.ilpanich:axiam-sdk-kotlin) |
| C# | axiam-csharp-sdk | NuGet |
| PHP | axiam-php-sdk | Packagist |
| Go | axiam-go-sdk | pkg.go.dev |
| Swift | axiam-swift-sdk | Swift Package Manager (github.com/ilpanich/axiam-swift-sdk) |
| C | axiam-c-sdk | CMake (FetchContent / find_package) |
| C++ | axiam-cplusplus-sdk | CMake (FetchContent / vcpkg) |
AXIAM ships a vendor-neutral benchmark framework in benchmarks/
for comparing it against other open-source IAM systems (Keycloak, Zitadel, …)
across three axes: performance (throughput / latency), resource efficiency
(throughput per CPU core and per GiB — competitor-level performance at a smaller
footprint?), and security posture (the same workload replayed from plaintext
HTTP up to mTLS with client-certificate auth, quantifying what each tier costs).
It drives standard OAuth2/OIDC flows through a per-target adapter so every system
is measured on equal footing, and includes scaffolded per-SDK client-overhead
benchmarks that consume each SDK from its published package. See
benchmarks/README.md and
benchmarks/docs/methodology.md.
Apache License v2.0