The IAM System is a robust, enterprise-grade web application designed to demonstrate advanced Identity and Access Management principles. It provides a secure foundation for managing user identities, enforcing Role-Based Access Control (RBAC), and ensuring compliance through immutable audit logging.
Built with a security-first mindset, this system mitigates common vulnerabilities (OWASP Top 10) by implementing Multi-Factor Authentication (MFA), secure session management, and cryptographic integrity checks for audit trails. It serves as a comprehensive reference implementation for modern authentication workflows and secure software architecture.
The application is built using a modern, scalable technology stack:
| Layer | Technology | Key Features |
|---|---|---|
| Frontend | React 18, Vite | Component-based UI, fast HMR, responsive design |
| Backend | Node.js, Express.js | Event-driven architecture, RESTful API |
| Database | PostgreSQL 15 | Relational data, ACID transactions, complex queries |
| Security | bcryptjs, speakeasy | Adaptive hashing, TOTP generation (RFC 6238) |
| Auth | JWT, AES-256-GCM | Stateless sessions, secret encryption at rest |
| Validation | Joi | Strict request payload validation |
The system follows a tiered architecture separating concerns between the presentation, business logic, and data layers.
graph TD
Client[React Frontend] -->|HTTPS/JSON| Gateway[API Gateway / Load Balancer]
Gateway -->|Rate Limited| Server[Node.js Express Server]
subgraph "Backend Services"
Server --> Auth[Auth Service]
Server --> RBAC[RBAC Middleware]
Server --> Logs[Audit Logger]
end
subgraph "Data Persistence"
Auth -->|Read/Write| DB[(PostgreSQL)]
Logs -->|Append Only| DB
end
- Multi-Factor Authentication (MFA): Time-based One-Time Password (TOTP) integration compatible with Google/Microsoft Authenticator.
- Secure Authentication: bcryptjs password hashing (cost factor 12), account lockout policies, and session management via HTTP-only cookies.
- Rate Limiting: granular protection against brute-force attacks on login, MFA, and API endpoints.
- RBAC (Role-Based Access Control): Granular permission system with distinct
Admin,User, andAuditorroles. - User Management: Full lifecycle management (CRUD) for user accounts, role assignments, and status toggling.
- Profile Management: Self-service secure password changes and MFA enrollment.
- Tamper-Evident Audit Logs: Append-only logging with cryptographic hash chaining to detect integrity violations.
- Real-Time Monitoring: Admin-only dashboard featuring live activity feeds and system statistics.
- Data Export: Admin-only log filtering and export capabilities (JSON/CSV) for external auditing.
Follow these instructions to set up the project locally for development and testing.
- Node.js v18+
- PostgreSQL v14+
- npm or yarn
-
Clone the Repository
git clone https://github.com/joserohit264/zero-trust-IAM cd zero-trust-IAM -
Install Dependencies
# Install backend dependencies npm install # Install frontend dependencies cd frontend && npm install && cd ..
-
Environment Configuration Create a
.envfile in the root directory:cp .env.example .env
Update
DATABASE_URLin.envto match your local PostgreSQL credentials. -
Database Setup Create the database and run migrations:
# Create the database using psql (or pgAdmin) psql -U postgres -c "CREATE DATABASE iam_db;" # Run schema migrations npm run db:migrate # Seed default users npm run db:seed
-
Run the Application Start both the backend API and frontend dev server:
# Terminal 1: Backend (http://localhost:5000) npm run dev # Terminal 2: Frontend (http://localhost:3000) cd frontend && npm run dev
- Security Considerations: Details on encryption, session handling, and threat models.
- Database Schema: Entity Relationship Diagrams (ERD) and table definitions.
This project is licensed under the MIT License - see the LICENSE file for details.