Skip to content

Junctional Identity Manager Docs

Identity synchronisation that deploys in minutes. Self-hosted, container-native, air-gap ready.

Get started Learn the concepts

Home

JIM System Context Administrators manage JIM through the web UI and PowerShell, and automation clients call its REST API. An OIDC Identity Provider authenticates sign-in. JIM synchronises with Directory Services over LDAP and LDAPS, imports from HR systems via CSV, reads and writes file systems, reads and writes enterprise databases over SQL, and synchronises with cloud applications over SCIM 2.0. Administrator configures & operates >_ Automation Client CI/CD · API keys Identity Provider OIDC single sign-on JIM Junctional Identity Manager self-hosted identity synchronisation Directory Services Active Directory · LDAP HR Systems authoritative source File Systems CSV & flat files Enterprise Databases SQL Server · Oracle Cloud Applications SCIM 2.0 web UI · PowerShell REST API OIDC LDAP/LDAPS imports · CSV reads & writes SQL SCIM 2.0

JIM in context: administrators and automation work through its UI and API while it synchronises identity data with your systems. Moving dots trace identity data in flight.

✨ Key Features

  • Hub-and-Spoke Synchronisation

    Central metaverse architecture for identity correlation across all Connected Systems. Bidirectional sync of Users, Groups, and custom object types.

  • Multi-Directory LDAP

    Active Directory, OpenLDAP, 389 Directory Server, and other RFC 4512-compliant directories, all supported out of the box.

  • Container-Native Deployment

    Deploys as a single Docker stack with no legacy infrastructure requirements. Bundled or external PostgreSQL.

  • Single Sign-On (SSO)

    OpenID Connect authentication with any OIDC-compliant Identity Provider. PKCE for enhanced security.

  • Expression-Based Transforms

    Transform data using expressions with built-in functions for common identity operations.

  • REST API & PowerShell

    Full REST API with OpenAPI documentation, plus a cross-platform PowerShell module for automation and Identity as Code.

  • Air-Gapped Ready

    Fully functional without internet connectivity. No cloud dependencies -- designed for sensitive and high-assurance environments.

  • Extensible Connectors

    Built-in LDAP and CSV connectors, with a framework for developing custom connectors for bespoke scenarios.

  • Attribute Priority

    Deterministic precedence when multiple Connected Systems contribute the same Metaverse attribute, with "Null is a value" assertion, next-contributor hand-over, and per-value provenance.

  • Configuration Change History

    Versioned who/what/when audit across every configuration type, with secret redaction and a reason-for-change prompt.

  • Extensible Metaverse Schema

    Create your own Metaverse Object Types and Attributes from the portal, REST API or PowerShell, with safe deletion and full audit. Built-in attributes carry SCIM 2.0 and LDAP Standard Mappings.

  • Real-Time Operations

    Run Profile progress, throughput and time remaining stream live to the portal, pushed from the database rather than polled, with Get-JIMActivity -Follow for the terminal.

🎯 Scenarios

JIM supports common Identity Governance & Administration (IGA) scenarios:

  • Joiner/Mover/Leaver (JML) Automation: Synchronise users from HR systems to directories, applications, and downstream systems
  • Attribute Writeback: Keep HR systems current by writing IT-managed attributes back (e.g. email addresses, phone numbers)
  • Domain Consolidation: Prepare for cloud migration, simplification, or organisational mergers
  • Domain Migration: Support divestitures and system decommissioning
  • Identity Correlation: Bring together user and entitlement data from disparate business applications

🚀 What Makes JIM Different

Enterprise identity synchronisation typically requires cloud connectivity, complex infrastructure, or expensive licensing. JIM takes a different approach: it deploys as a single Docker stack, runs entirely on-premises, and works in air-gapped networks with no external dependencies. Source-available code means you can inspect, audit, and verify everything JIM does with your identity data.

  • Air-gapped deployment
  • No cloud dependencies
  • Container-native
  • Source available
  • SSO with any OIDC provider
  • Full REST API
  • PowerShell automation

  • Getting Started

    Deploy JIM and run your first synchronisation.

  • Concepts

    Understand the metaverse, Connected Systems, Synchronisation Rules, and more.

  • Administration

    Configure, monitor, and manage your JIM deployment.

  • Connectors

    Connect JIM to LDAP directories, CSV files, and more.

State of Development

JIM has completed pre-release stabilisation and moved well beyond its initial MVP. The core identity lifecycle is fully functional:

  • Import identities from source systems (LDAP, CSV)
  • Sync to reconcile identities in the central metaverse
  • Export changes to target systems with Pending Export management
  • Schedule automated synchronisation using cron or interval-based triggers

The platform has been hardened for production, with bounded-memory pipelines validated at 500,000-user scale (synchronised cross-domain across two directories, with groups of up to 495,000 members), an OWASP Top 10:2025 assessment, supply chain hardening, and comprehensive integration test coverage across all synchronisation scenarios. See the Product Roadmap for what is coming as JIM progresses towards its first stable release.

💬 Community & Support

JIM is built in the open. GitHub Discussions is the place to engage with the maintainers and other users.

  • Questions and setup help
    Start a thread in the Q&A category. Search existing threads first.
  • Feature ideas and suggestions
    Post in the Ideas category. Upvotes on existing ideas inform roadmap prioritisation; prefer adding signal to a duplicate over creating a new thread.
  • Bug reports
    Open a GitHub Issue.
  • Security vulnerabilities
    Follow the Security Policy; please do not report security issues in public Issues or Discussions.

Licensing

JIM uses a Source-Available model where it is free to use in non-production scenarios, but requires a commercial licence for use in production scenarios. Full details can be found here.

More Information

Please visit https://junctional.io for more information.