SinonAuth — Active Directory & Cloud IAM, on Linux, No Windows Licence

Domain Services

Domain join, GPO, trusts, NTLM, sites

Services

API, LDAP, KDC, RADIUS, CA, Replication, Worker, DNS

Auth Protocols

LDAP, Kerberos, OAuth/OIDC, SAML, RADIUS (NTLM coming soon)

Deployment Modes

Bare metal to air-gapped

Certificate Authority

Root + intermediate CA, OCSP, CRL, SCEP

Domain Controller

SinonAuth nodes act as full domain controllers. They hold the directory database, run the Kerberos KDC, answer LDAP queries, process Group Policy, and replicate changes to peer controllers. Promote a new node with a single command. Clients (Windows, Linux, macOS) discover controllers via DNS SRV records — exactly like AD.

Domain Join (Windows & Linux)

Windows machines join via netdom or the familiar Settings UI; Linux machines join via realm join (SSSD/Winbind). Computer accounts are created in the directory, Kerberos keytabs are provisioned, and DNS PTR records are registered automatically. Joined machines authenticate users against SinonAuth with Kerberos tickets — no local accounts needed.

AD-Compatible Schema

Full Active Directory object classes and attributes: sAMAccountName, userPrincipalName, memberOf, distinguishedName, objectGUID, objectSid, userAccountControl, pwdLastSet, lastLogon, servicePrincipalName, and the complete AD user/computer/group schemas. Tools like RSAT, ldapsearch, and PowerShell AD cmdlets work without modification.

Kerberos V5 KDC

Built-in Key Distribution Centre handling AS-REQ / AS-REP and TGS-REQ / TGS-REP on port 88 (UDP + TCP). Pre-authentication, session key generation, ticket building, and multiple encryption types (AES-256, AES-128, RC4-HMAC for legacy). Service Principal Names (SPNs) and constrained/unconstrained delegation. Replaces the Windows KDC entirely.

NTLM Authentication Coming Soon

NTLMv2 challenge-response authentication for legacy clients and applications that don't support Kerberos. NT hash storage with configurable NTLM policy (allow, audit-only, deny) to manage migration away from NTLM. Pass-through authentication for domain-joined machines. NTLM audit logging to identify applications still relying on legacy auth.

Domain & Forest Trusts

Establish trust relationships between SinonAuth domains (or forests) for cross-domain authentication. One-way and two-way trusts, transitive and non-transitive. Cross-realm Kerberos trust for ticket referral. External trusts to existing Windows AD forests for phased migration. Selective authentication to limit which users traverse the trust.

LDAPv3 Directory Server

Full LDAPv3 server built on ldapjs with bind, search, add, modify, delete, compare, modifyDN, and extended operations. LDAP filters compile to parameterised SQL on JSONB with GIN indexes. Supports LDAPS (port 636) and StartTLS. Compatible with ldapsearch, ldapadd, RSAT, and all standard LDAP clients.

RADIUS Server

Authentication (port 1812) and accounting (port 1813) with five authenticator backends: PAP, CHAP, MS-CHAPv2, EAP-TLS, and EAP-PEAP. Per-tenant RADIUS client management with shared secrets. Integrates with VPN concentrators, wireless controllers, and network access control.

AD-Integrated DNS

Publish _ldap._tcp, _kerberos._tcp, _kpasswd._tcp, and _gc._tcp SRV records so clients auto-discover domain controllers. Built-in DNS server (port 53) or integration with BIND / external DNS via zone export. Dynamic DNS updates from domain-joined machines. Site-aware service location for multi-site deployments.

Directory Information Tree

Hierarchical DIT with organisational units, users, groups (security, distribution, dynamic), computers, and service accounts. Distinguished Name resolution, schema management, and a search engine that translates LDAP filter ASTs to efficient SQL queries. Every entry has both typed columns and JSONB attributes for full AD/LDAP compatibility.

Users, Groups & Computers

Full lifecycle management: create, update, disable, delete, password reset, group membership, computer join/disjoin. Security groups with nesting and scope (domain-local, global, universal), distribution groups for mail, and dynamic groups with filter-based membership. Bulk import from CSV with preview and validation.

AD Sites & Services

Define AD sites, subnets, and site links, the same topology model as AD Sites and Services MMC. Inter-site replication schedules control bandwidth. Intra-site replication is near-instant. Cost-based link selection drives automatic replication path computation. Subnet-to-site mapping ensures clients authenticate against the nearest domain controller.

OAuth 2.0 / OpenID Connect

Full OIDC provider with authorization code flow (+ PKCE), client credentials, device code, and refresh token rotation. Application registrations with scopes, redirect URIs, and consent. JWT access tokens with configurable claims (sub, tid, role, scopes) compatible with all SOC-in-a-Box products.

SAML 2.0 Identity Provider

SP-initiated and IdP-initiated SSO with XML-signed assertions. Service provider configuration with metadata import, attribute mapping, and NameID format selection. Supports legacy enterprise applications that require SAML alongside modern OIDC apps.

Multi-Factor Authentication

Three live MFA methods: TOTP (RFC 6238 authenticator apps), WebAuthn/FIDO2 (hardware keys and biometrics), and backup codes, with SMS OTP, email OTP, and push notifications coming soon. Per-user MFA enrolment, recovery flows, and policy-driven enforcement. Passwordless login via magic links or client certificate authentication.

Conditional Access

Risk-based access policies that evaluate user identity, group membership, device compliance, IP location, application sensitivity, and sign-in risk. Actions: require MFA, block access, limit session duration, enforce authentication methods, or require compliant devices. Target all users, specific groups, or individual apps.

Federation & External IdP

Federate with external identity providers: Azure Entra ID, Google Workspace, Okta, PingFederate, AWS Cognito, Apple, and generic OIDC/SAML. Trust relationships with configurable claim mapping and JIT provisioning. Users authenticate against their home IdP while SinonAuth manages authorisation.

SCIM 2.0 Provisioning

Inbound SCIM for receiving user and group provisioning from external identity providers. Outbound SCIM for pushing identity changes to downstream applications. Automatic user lifecycle (create, update, deactivate) and group membership sync. Compliant with the SCIM 2.0 specification (RFC 7643/7644).

Root & Intermediate CA

Generate root and intermediate Certificate Authorities with RSA-4096 or EC-P384 keys. Hierarchical CA chain with configurable validity periods, key usage, and extended key usage. Offline root CA support for high-security deployments.

Certificate Templates

Pre-built templates for common use cases: user authentication, computer authentication, web server (TLS), code signing, email (S/MIME), and smart card logon. Custom templates with configurable subject fields, validity, key usage, and auto-enrolment policies.

Enrolment & SCEP

Certificate request and approval workflow with pending, issued, denied, and revoked states. SCEP (Simple Certificate Enrolment Protocol) for automated device enrolment. Bulk enrolment for fleet provisioning. Certificate renewal reminders and auto-renewal policies.

OCSP Responder

Online Certificate Status Protocol responder on port 2560 for real-time certificate validation. Eliminates the need for CRL distribution point polling. Signed OCSP responses with configurable caching for high-throughput environments.

CRL Distribution

Certificate Revocation Lists published at configurable intervals. Delta CRLs for efficient updates. HTTP and LDAP distribution points. Automatic CRL regeneration on certificate revocation.

Key Escrow

Optional key escrow for encryption certificates, enabling key recovery for compliance and eDiscovery requirements. Escrow keys are encrypted with the CA's key and stored separately from issued certificates. Full audit trail of escrow and recovery operations.

Privileged Identity Management

Just-in-time role activation with configurable maximum duration (1 hour to 365 days). Require MFA, justification text, or manager approval before activation. Time-bound elevated access that automatically expires. Activation audit trail with reason, approver, and expiry recorded.

Entitlement Management

Access packages group resource scopes into requestable bundles. Catalogs organise packages by department or purpose. Assignment policies control who can request, whether approval is required, and maximum duration. Auto-assignment rules for group-based entitlements.

AD Security Tier Model

Three infrastructure tiers: T0 (Domain Controllers, Forest Admins), T1 (Servers, Application Admins), T2 (Workstations, End Users), with built-in templates and cross-tier access prevention. Accounts classified in T0 cannot be used to access T2 resources and vice versa. Custom tier templates for non-standard environments.

Group Policy Objects

Define and link GPOs to organisational units with a visual editor covering password policy, account lockout, session limits, login restrictions, audit settings, and security options. GPO inheritance and precedence follow the AD model. Linked to OUs, sub-tenants, or the entire tenant.

Access Reviews

Periodic reviews of who has access to what. Reviewers approve, deny, or flag assignments. Automated reminders and escalation for overdue reviews. Review results feed into compliance reports and can trigger automatic revocation of stale access.

Network Access Policies

IP-based access restrictions with CIDR ranges, IP ranges, domain wildcards, and named policy sets. Apply per tenant, application, or user group. Block or allow access from specific networks, VPNs, or geographic regions. Every policy evaluation is logged for audit.

Azure Entra ID Sync

Bidirectional sync of users, groups, and role assignments with Microsoft Entra ID (Azure AD). Map SinonAuth attributes to Entra claims. Sync on schedule or on-demand. Conflict resolution with configurable source-of-truth priority. Microsoft Graph API integration.

AWS Cognito Sync

Sync user pools and groups with AWS Cognito. Map SinonAuth users to Cognito user pool entries with attribute mapping. Support for Cognito custom attributes and app client configuration. Keep AWS workloads authenticated against your on-prem directory.

External LDAP Sync

Import users and groups from existing LDAP directories (OpenLDAP, 389DS, eDirectory). Configurable base DN, search filter, and attribute mapping. One-way or bidirectional sync with conflict detection. Migrate from legacy directories without downtime.

USN-Based Replication

Every directory change increments an Update Sequence Number (USN), mirroring the Active Directory replication model. Peers sync via a changelog with vector clocks for conflict detection and last-writer-wins resolution. Replication runs on port 4820 with TLS encryption. Same model as AD DRS (Directory Replication Service).

FSMO-Style Role Holders Coming Soon

Flexible single-master operation roles ensure certain directory-wide operations (schema changes, domain naming, RID allocation, PDC emulator, infrastructure) are authoritative on a single node. Role transfer and seizure for planned maintenance or disaster recovery. Roles are tracked in the replication metadata and discoverable via LDAP.

Convergence & Health

Replication status dashboard shows per-node sync state, lag, and last sync timestamp — similar to repadmin /showrepl. Automatic conflict resolution with configurable merge strategies. Health checks detect and alert on replication failures. Changelog viewer for debugging sync issues.

HMAC-Chained Audit Log

Every audit entry includes an HMAC hash of the previous entry, forming a tamper-evident chain. Any insertion, deletion, or modification breaks the chain and is detected on verification. Covers logins, password changes, group modifications, policy edits, certificate operations, and all administrative actions.

Sign-In Analytics

Detailed sign-in logs with IP address, user agent, authentication method, MFA status, conditional access evaluation, and result (success, failure, blocked). Risk scoring per sign-in. Dashboards showing failed login trends, unusual locations, and brute-force detection.

Compliance Reports

Pre-built reports for SOC 2, ISO 27001, GDPR, and HIPAA requirements. Password policy compliance, MFA adoption rates, privileged access usage, certificate expiry tracking, and stale account identification. Export to PDF, CSV, or JSON for external audit tools.

Multi-Tenant with Sub-Tenants

Top-level tenants with optional sub-tenant hierarchies for departments, business units, or MSP customers. Each tenant has isolated users, groups, policies, certificates, and OAuth clients. PostgreSQL row-level security as defence-in-depth. Sub-tenant admins manage their scope independently.

Per-Tenant Feature Gates

Enable or disable features per tenant: LDAP, Kerberos, RADIUS, CA, OAuth/OIDC, SAML, MFA, SCIM, Conditional Access, PIM, Entitlements, Cloud Sync, Replication, and GPO. Feature gate middleware enforces access at the API level. Perfect for tiered service offerings.

Platform Integration

SinonAuth serves as the identity backend for all SOC-in-a-Box products. Same JWT claim structure (sub, tid, role, scopes, iss) accepted by SinonMeet, SinonForge, SinonStore, and Umbra. Single sign-on across the entire platform. Shared tenant model for unified identity.

Application Registrations

Register OAuth 2.0 / OIDC clients with configurable grant types, redirect URIs, scopes, and token lifetimes. API permission management with consent framework. Service principal support for daemon applications and automated workflows.

TLS Certificate Management

Upload PEM certificates, generate self-signed certificates for development, toggle certificates active/inactive, and sync configuration with Nginx. Certificate dashboard showing expiry dates, SANs, issuer details, and fingerprints. Per-tenant and platform-level certificate management.

Self-Service Portal

End users manage their own profile, password, MFA devices, sessions, group memberships, certificates, and devices through a dedicated self-service interface. Reduces helpdesk burden while maintaining security controls and audit logging.

Bare Metal

Direct install on Ubuntu 24.04/26.04 LTS. Automated script handles Node.js, PostgreSQL, Redis, Nginx, TLS, and eight systemd services (API, LDAP, KDC, RADIUS, CA, Replication, Worker, DNS). Non-interactive mode for CI/CD pipelines.

Docker Compose

Three profiles: minimal (API + PostgreSQL + Redis), standard (+ LDAP + CA + Worker + Nginx), and full (+ KDC + RADIUS + Replication + DNS). Health checks, volume mounts, and environment configuration.

Kubernetes & Helm

Production Helm chart with StatefulSet for replication, Deployments for all other services. Bitnami PostgreSQL and Redis subcharts. LoadBalancer/NodePort services for LDAP (389/636), KDC (88), and RADIUS (1812/1813). NetworkPolicy for inter-service isolation.

Cloud VMs

Deploy on AWS EC2, Azure VMs, GCP Compute, or any provider. Same bare metal installer with cloud-specific network configuration for protocol ports (LDAP, Kerberos, RADIUS).

Virtual Machines

VMware, Hyper-V, Proxmox, or KVM. Same installer as bare metal, optimised for virtualised networking. Export OVA templates for rapid provisioning.

Air-Gapped

Fully offline installation for classified or isolated networks. Pre-packaged Node.js, npm modules, PostgreSQL, Redis, and all dependencies. All eight services (including LDAP, Kerberos, RADIUS, and CA) work without internet connectivity.

You Own Your Identities

Whether you self-host or let SinonTech host it for you, you own 100% of your user data, credentials, certificates, and policies. We never access, view, or mine your identity data. Full data portability — export everything at any time.

No Per-User Fees

Unlimited users, unlimited groups, unlimited applications, unlimited MFA devices, unlimited certificates. Scale to your capacity without per-seat licensing. No surprises when your organisation grows — unlike Azure Entra, Okta, and other cloud identity providers.

Regulatory Compliance

Meet GDPR, UK DPA, HIPAA, SOC 2, and ISO 27001 requirements. Tamper-evident audit logging, configurable retention policies, data residency controls, and full chain-of-custody for identity operations. No third-party data processor agreements needed.