Operating Systems
for Identity

Preface

Building an Identity and Access Management (IAM) server from scratch is comparable to writing a kernel for a small operating system. Where an OS kernel manages memory, processes, and hardware access, an Identity Server manages principals, sessions, and authorization graphs.

Most contemporary web applications delegate login to third-party services such as Auth0, Clerk, or Cognito. These services are excellent for prototypes. But as a product matures into a platform — as it accumulates multi-tenant workspaces, custom auth policies, OIDC federation, fine-grained RBAC, and audit obligations — the rigid constraints of an external IAM begin to suffocate product development.

This book follows the construction of Rooiam, a fully custom, open-source IAM platform written in Rust (Actix-web), backed by PostgreSQLand Redis. Each chapter dissects one core problem of identity — from the most fundamental question of what is a user? all the way through OIDC federation, hardware-bound passkeys, cryptographic audit trails, and enterprise network policy.

Who This Book Is For

This book is written for software engineers at any level who want to understand identity systems from first principles. You do not need prior security experience. Each chapter builds on the previous one, introduces the theoretical problem before any code, and always shows you the actual Rust source that Rooiam runs in production.

How Each Chapter Works

Every chapter follows the same four-part structure:

1. The Problem — a clear, intuitive statement of the failure mode or attack that motivates the design.
2. Theory — the computer-science or cryptographic concept that solves the problem, explained from scratch.
3. Database Design — the PostgreSQL schema that encodes the solution durably and correctly.
4. Rust Implementation — the actual rooiam-server code that executes the solution on every request.

Each chapter closes with a Chapter Summary and a short set ofExercises to solidify understanding.

The Stack at a Glance

Table of Contents

1. Chapter 1: The Core Database
2. Chapter 2: Magic Link Authentication
3. Chapter 3: Stateful Sessions
4. Chapter 4: Social Logins
5. Chapter 5: Multi-Tenant Architecture
6. Chapter 6: The OIDC Provider
7. Chapter 7: Threat Modeling
8. Chapter 8: Permissions & Roles
9. Chapter 9: MFA & Passkeys
10. Chapter 10: Audit Logs
11. Chapter 11: Machine Identity & API Keys
12. Chapter 12: Corporate Guardrails