Hanzo IAM - Identity and Access Management Server

docker run -d --name hanzo-iam -p 8000:8000 ghcr.io/hanzoai/iam:latest
# Open http://localhost:8000 for admin UI

# compose.yml
services:
  iam:
    image: ghcr.io/hanzoai/iam:latest
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgres://hanzo:hanzo@postgres:5432/iam?sslmode=disable
      - REDIS_URL=redis://redis:6379
      - IAM_ORIGIN=https://hanzo.id
      - ENABLE_MULTI_TENANT=true
      - ALLOWED_ORIGINS=hanzo.id,zoo.id,lux.id,pars.id,iam.hanzo.ai
    volumes:
      - ./init_data.json:/app/init_data.json:ro
    depends_on:
      postgres:
        condition: service_healthy

  postgres:
    image: ghcr.io/hanzoai/sql:latest
    environment:
      POSTGRES_USER: hanzo
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
      POSTGRES_DB: iam
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hanzo -d iam"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: ghcr.io/hanzoai/kv:latest
    command: kv-server --appendonly yes
    volumes:
      - redis_data:/data

volumes:
  postgres_data:
  redis_data:

git clone https://github.com/hanzoai/iam.git
cd iam

# Backend
go build -o server .

# Frontend
cd web && pnpm install && pnpm run build && cd ..

# Configure
cp conf/app.dev.conf conf/app.conf
# Edit conf/app.conf with your database credentials

# Run
./server

# Get all users in an organization
curl -s "https://iam.hanzo.ai/api/get-users?owner=hanzo" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}"

# Create a new application
curl -X POST "https://iam.hanzo.ai/api/add-application" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "owner": "admin",
    "name": "app-myservice",
    "organization": "hanzo",
    "clientId": "my-client-id",
    "clientSecret": "my-client-secret",
    "redirectUris": ["https://myservice.hanzo.ai/callback"],
    "expireInHours": 168,
    "grantTypes": ["authorization_code", "implicit"]
  }'

# Update user balance (billing integration)
curl -X POST "https://iam.hanzo.ai/api/update-user" \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "owner": "hanzo",
    "name": "username",
    "balance": 10000
  }'

┌──────────────────────────────────────────────────────────────┐
│                    Hanzo IAM Server (Go)                      │
├──────────────┬──────────────┬──────────────┬─────────────────┤
│  OAuth2/OIDC │  SAML/CAS    │  LDAP/SCIM   │  WebAuthn/MFA  │
├──────────────┴──────────────┴──────────────┴─────────────────┤
│  Beego Router → Controllers → Object (business logic)        │
├──────────────┬──────────────┬──────────────┬─────────────────┤
│  40+ IdPs    │  Casbin RBAC │  MCP Server  │  WAF (Coraza)  │
├──────────────┴──────────────┴──────────────┴─────────────────┤
│  PostgreSQL/MySQL/SQLite  │  Redis/Valkey  │  File Storage   │
└───────────────────────────┴────────────────┴─────────────────┘
         ↑                        ↑                    ↑
  ┌──────┴──────┐          ┌──────┴──────┐     ┌──────┴──────┐
  │  hanzo.id   │          │  cloud.     │     │  platform.  │
  │  (login UI) │          │  hanzo.ai   │     │  hanzo.ai   │
  └─────────────┘          └─────────────┘     └─────────────┘

iam/
├── main.go              # Entry point (Beego bootstrap, filter chain)
├── conf/                # Configuration files (INI format)
│   ├── app.conf         # Active config (gitignored in prod)
│   ├── app.dev.conf     # Docker dev (PostgreSQL)
│   ├── app.prod.conf    # Production (hanzo.id)
│   ├── app.staging.conf # Staging (stg.hanzo.id)
│   └── waf.conf         # Coraza WAF rules
├── controllers/         # HTTP handlers (Beego controllers)
│   ├── auth.go          # OAuth2 authorization flows
│   ├── token.go         # Token issuance and validation
│   ├── account.go       # User account management
│   ├── user.go          # User CRUD
│   ├── application.go   # Application management
│   ├── organization.go  # Organization management
│   ├── permission.go    # Permission management
│   ├── role.go          # Role management
│   ├── mfa.go           # Multi-factor authentication
│   ├── webauthn.go      # WebAuthn/Passkeys
│   ├── saml.go          # SAML SSO
│   ├── cas.go           # CAS protocol
│   ├── ldap.go          # LDAP management
│   ├── scim.go          # SCIM provisioning
│   ├── webhook.go       # Webhook management
│   ├── wellknown_oidc_discovery.go  # .well-known endpoints
│   └── wellknown_oauth_prm.go      # OAuth metadata
├── object/              # Core business logic (models + ORM)
│   ├── adapter.go       # Database adapter
│   ├── ormer.go         # xorm ORM setup
│   └── transaction.go   # Billing transactions
├── routers/             # Beego filters and route definitions
│   ├── router.go        # All API route registrations
│   ├── authz_filter.go  # Authorization filter
│   ├── cors_filter.go   # CORS handling
│   ├── secure_cookie_filter.go  # Secure cookie enforcement
│   ├── static_filter.go # SPA static file serving
│   └── mcp_util.go      # MCP protocol utilities
├── idp/                 # Identity provider implementations
│   ├── github.go, google.go, facebook.go, ...  # 30+ providers
│   ├── metamask.go, web3onboard.go              # Web3 providers
│   ├── goth.go          # Goth library integration (40+ providers)
│   └── provider.go      # Provider interface
├── mcp/                 # MCP (Model Context Protocol) server
│   ├── base.go          # MCP server setup and tool registry
│   ├── auth.go          # MCP auth tools
│   ├── application.go   # MCP app management tools
│   └── permission.go    # MCP permission tools
├── authz/               # Casbin authorization engine
├── ldap/                # LDAP server implementation
├── radius/              # RADIUS server implementation
├── scim/                # SCIM protocol implementation
├── captcha/             # CAPTCHA generation
├── certificate/         # X.509 certificate management
├── email/               # Email templates and sending
├── notification/        # Push notifications
├── proxy/               # HTTP client proxy
├── storage/             # File storage backends
├── web/                 # React admin UI (Ant Design)
│   ├── src/             # React source
│   └── package.json     # pnpm, React 18, Ant Design 5
├── init_data.json       # Bootstrap data (orgs, apps, users)
├── compose.yml          # Production Docker Compose
├── Dockerfile           # Multi-stage (frontend + backend + alpine)
├── Makefile             # Build, test, deploy commands
└── k8s.yaml             # Kubernetes deployment manifest

appname = hanzo-iam
httpport = 8000
runmode = dev
driverName = postgres
dataSourceName = user=hanzo password=xxx host=postgres port=5432 sslmode=disable dbname=hanzo_iam
dbName = hanzo_iam
redisEndpoint = redis:6379
authState = "hanzo"
origin = https://hanzo.id
staticBaseUrl = "https://cdn.hanzo.ai"
ldapServerPort = 389
ldapsServerPort = 636
radiusServerPort = 1812
radiusDefaultOrganization = "hanzo"
initDataNewOnly = true
initDataFile = "./init_data.json"
logConfig = {"adapter":"file", "filename": "logs/hanzo-iam.log", "maxdays":99999}
quota = {"organization": -1, "user": -1, "application": -1, "provider": -1}

# Database
POSTGRES_USER=hanzo
POSTGRES_PASSWORD=<generate-secure-password>
POSTGRES_DB=iam

# IAM server
IAM_ORIGIN=https://iam.hanzo.ai
ENCRYPTION_KEY=<32-byte-hex-key>
ENABLE_MULTI_TENANT=true
ALLOWED_ORIGINS=hanzo.id,zoo.id,lux.id,pars.id,iam.hanzo.ai

# Per-org client secrets (override init_data.json placeholders)
HANZO_CLIENT_SECRET=<generate-secret>
ZOO_CLIENT_SECRET=<generate-secret>
LUX_CLIENT_SECRET=<generate-secret>
PARS_CLIENT_SECRET=<generate-secret>

# Email (optional)
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USER=noreply@hanzo.ai
SMTP_PASSWORD=<email-password>

driverName = postgres
dataSourceName = user=hanzo password=xxx host=postgres port=5432 sslmode=disable dbname=hanzo_iam

driverName = mysql
dataSourceName = hanzo:pass@tcp(localhost:3306)/
dbName = hanzo_iam

make dev          # Start local dev with Docker Compose (PostgreSQL)
make dev-down     # Stop local dev
make run          # Run Go server locally (go run)
make backend      # Build Go binary to bin/manager
make frontend     # Build React admin UI (pnpm)
make ut           # Run Go unit tests with coverage
make docker-build # Build Docker image
make docker-push  # Push to ghcr.io/hanzoai/iam
make deploy       # Helm deploy to K8s
make staging      # Start staging compose
make prod         # Start production compose
make build-prod   # Build and push production image

import "github.com/hanzoid/go-sdk/iamsdk"

iamsdk.InitConfig(
    "https://hanzo.id",
    "hanzo-app-client-id",
    "hanzo-app-client-secret",
    "cert-hanzo",
    "hanzo",
    "app-hanzo",
)

// Validate a token
claims, err := iamsdk.ParseJwtToken(token)

// Get user
user, err := iamsdk.GetUser("admin/username")

import { SDK } from 'iam-js-sdk'

const sdk = new SDK({
  serverUrl: 'https://hanzo.id',
  clientId: 'hanzo-app-client-id',
  appName: 'app-hanzo',
  organizationName: 'hanzo',
})

// Start auth
sdk.signin_redirect()

// Parse callback
const token = sdk.exchangeForAccessToken()

curl -f http://localhost:8000/api/health