Junctional Identity Manager (JIM)
JIM is a modern Identity Management system designed for organisations with complex identity synchronisation requirements. It is self-hosted, container-deployable, and works in both connected and air-gapped networks. Features include:
- Hub-and-spoke architecture using a central metaverse for identity correlation
- Bidirectional synchronisation of Users, Groups, and custom object types
- Attribute Priority: deterministic precedence when multiple systems contribute the same attribute
- Extensible Metaverse schema: create your own Object Types and Attributes, with SCIM 2.0 and LDAP Standard Mappings on the built-ins
- Multi-directory LDAP support: AD DS, OpenLDAP, 389 Directory Server, and RFC 4512-compliant ones
- Built-in scheduler that supports parallel operations
- Validated at 500,000-user scale (with tens of thousands of groups of up to 495,000 members)
- Transform data using expressions with extensive built-in functions for common identity operations
- Built-in LDAP, File, SQL (Microsoft SQL Server, Oracle Database) and SCIM 2.0 Client connectors, plus a SCIM 2.0 Service Provider Connector (Preview) that lets identity providers push Users and Groups to JIM (more coming)
- Generated Values: unique account names, employee numbers and badge codes, checked against the target systems before they are issued and never reissued to someone new
- Passwords: initial passwords for newly provisioned objects, on-demand password setting, and Password Synchronisation to every configured Connected System, queued, encrypted at rest and retried
- Preview before you commit: a Configuration Change Preview shows which objects a proposed edit would affect, and Sync Preview shows what synchronising one object would do, changing nothing
- Run Profile Safeguards: cap how many creates, updates, deletes and detected deletions a single run may attempt, so one bad filter cannot become a mass change
- Service Health: see at a glance whether the Worker and Scheduler are alive, what each is doing, and whether JIM is running short of memory, before it fails
- Explain any outcome: the Inspect view shows where each Metaverse Object value came from and why it won, the Causality Explorer follows a change across objects and runs, and Object Changes searches every change by attribute and value
- Test configuration before it runs: try Attribute Flows, Scoping Criteria, Object Matching Rules and Generated Values against sample values or real objects, and save configuration test cases that catch a breaking change when you save
- Modern Web Portal and REST API with interactive Scalar API reference
- PowerShell automation for Identity as Code (IDaC) - deploy JIM instances in minutes, not months
- Real-time activity monitoring, pushed from the database rather than polled
- Configuration Change History: versioned who/what/when audit across all configuration types
- Single Sign-On (SSO) using OpenID Connect, with one-command registration for AD FS and Keycloak, and identity providers whose certificates come from your own certificate authority
- Dark/Light mode
What Makes JIM Different
Enterprise identity synchronisation typically requires cloud connectivity, complex infrastructure, or expensive licensing. JIM takes a different approach; it deploys as a single container stack on Docker or Podman, runs entirely on-premises, and works in air-gapped networks with no external dependencies. Source-available code means you can inspect, audit, and verify everything JIM does with your identity data.
JIM is designed to solve both enterprise-scale identity management and micro-deployment challenges for edge-sync scenarios.
Scenarios
JIM supports common Identity Governance & Administration (IGA) scenarios:
- Joiner/Mover/Leaver (JML) Automation - Synchronise users from HR systems to directories, dbs, etc.
- Attribute Writeback - Keep HR systems current by writing back IT attributes (e.g., emails, phone numbers)
- Domain Consolidation - Prepare for cloud migration, simplification, or organisational mergers
- Domain Migration - Support divestitures and system decommissioning
- Identity Correlation - Bring together user and entitlement data from disparate business applications
Benefits
Why choose JIM?
- Modern Architecture - Container-native design with no legacy infrastructure requirements
- Secure by Default - SSO via OpenID Connect, no shared service accounts needed
- Air-Gapped Ready - Fully functional without internet connectivity for sensitive environments
- Source Available - Transparent, auditable code you can inspect and verify
- Actively Developed - Built by identity management practitioners with decades of real-world experience
Architecture
JIM is a container-based distributed application implementing the metaverse pattern for centralised identity governance.
Components:
- JIM.Web - A website with integrated REST API, built using ASP.NET Blazor Server. The API is available at
/api/, with interactive Scalar API documentation at /api/reference. It also serves the SCIM 2.0 endpoint at /scim/v2/ that identity providers push Users and Groups to (Preview).
- JIM.Scheduler - A background service that triggers synchronisation runs using cron or interval-based schedules, with multi-step sequential and parallel execution
- JIM.Worker - A background service that processes import, sync, and export tasks with crash recovery and parallel execution support, delivers queued passwords, and stops its work before it runs out of memory, recording why
- JIM.PowerShell - A cross-platform PowerShell module (Windows, macOS, Linux) for full configuration and automation of JIM, enabling Identity as Code (IDaC)
- A database - PostgreSQL
For detailed architecture diagrams (Component level), see the Architecture documentation.
Quick Start
Deploy
The fastest way to get JIM running:
curl -fsSL https://junctional.io/get | sudo bash
This downloads everything you need, walks you through configuration, including JIM's HTTPS certificate, and starts JIM. For manual setup, air-gapped deployment, and production hardening, see the Getting Started guide.
Develop
The devcontainer includes everything pre-configured; .NET 10.0, PostgreSQL, Keycloak IdP with test users, shell aliases, and VS Code extensions. Or clone locally and open with the Dev Containers extension. See the Developer Guide for details.
Codespaces, one-time setup: JIM requires verified-signed commits. Before you create your codespace, enable GPG verification once at github.com/settings/codespaces (set it to all repositories). GitHub then signs and verifies every commit you make in any codespace automatically, with no keys to manage. Enabling it after a codespace is already running needs a stop/restart to take effect, so do it first.
Automate
Install-Module -Name JIM
Connect-JIM -Url "https://jim.example.com"
JIM includes a cross-platform PowerShell module for scripting, automation, and Identity as Code (IDaC).
State of Development
JIM is working towards its v1.0 milestone: Identity Lifecycle Complete. The core identity lifecycle is fully functional today:
- Import identities from source systems (LDAP directories, SQL databases, SCIM 2.0 services, CSV files), or receive them from identity providers over SCIM 2.0
- Sync to reconcile identities in the central metaverse
- Export changes to target systems with Pending Export management
- Schedule automated synchronisation using cron or interval-based triggers
For what is coming in v1.0 and beyond, see the Roadmap.
Community & Support
JIM is built in the open and we'd love to hear from people running it, evaluating it, or thinking about it. The best place to engage with us and other users is GitHub Discussions.
- Questions and setup help: Open a thread in the Q&A category. Search existing threads first; if your question is already there, add to it rather than starting a new one.
- Feature ideas and suggestions: Post in the Ideas category. Upvotes on existing ideas genuinely inform roadmap prioritisation, so prefer adding signal to a duplicate over creating a new thread.
- Bug reports: Open a GitHub Issue. If it turns out to be a usage question, we may convert it to a Discussion.
- Security vulnerabilities: Follow the responsible disclosure process in SECURITY.md; please do not report security issues in public Issues or Discussions.
Licensing
JIM uses a Source-Available model where it is free to use in non-production scenarios, but requires a commercial license for use in production scenarios. Full details can be found here.
Third-party components shipped inside the images carry their own licences; see third-party-notices.
More Information
