Passport ships 630+ unit tests at 95% pass rate, built on SOLID principles and Clean Architecture. This is a production-grade IAM platform — not a prototype.
27 packages (22 libraries + 5 apps) · Clean Architecture · React 18 + TypeScript + ASP.NET Core
Every authentication flow your users will need — local, social, federated, and enterprise SSO — all wired through the same provider interface.
Email / password authentication with bcrypt hashing, configurable password policies, rate limiting, and brute-force lockout protection.
Google, GitHub, and Microsoft social login. Configurable per tenant. OAuth tokens normalised into Passport's identity model — no provider-specific code in your app.
Passport is the identity provider for Discourse communities. Tokens, user sync, group mappings, and session management all handled by Passport. Live and in production.
Delegate to an existing Cognito user pool. Passport handles the UI, RBAC, and audit layer — Cognito handles the identity store and MFA.
Integrate with Microsoft Entra ID for enterprise customers. RBAC role mappings sync from Azure groups into Passport's permission model.
Okta as the identity backend with Passport's white-label screens on top. Fully tested against the Okta provider interface contract.
A complete administration console for managing users, roles, tenants, and security policy — with full audit visibility.
Real-time threat detection and compliance reporting. Your security team gets a live view of authentication health across all tenants.
All four IAM providers implement the same 6 interface contracts. The rest of the codebase never knows which provider is active.
Native provider benchmarked on local SQL. Cloud providers depend on network latency to the cloud region.
| Provider | Throughput | Latency |
|---|---|---|
| Passport Native | 2,000 – 3,000 req/s | <5ms local |
| AWS Cognito | ~500 req/s | 20–80ms |
| Azure AD | ~400 req/s | 30–100ms |
| Okta | ~300 req/s | 40–120ms |
Hierarchical roles, a permission resolver pattern, caching, and fail-secure design — built for production authorisation at scale.
Roles inherit permissions from parent roles. A SuperAdmin inherits everything. A TenantAdmin inherits tenant-scoped permissions. Custom roles extend the hierarchy without breaking existing assignments.
At request time, the resolver walks the role hierarchy for the authenticated user and tenant, materialises the effective permission set, and caches the result for 5 minutes per user session.
If the permission resolver encounters an error, access is denied — not granted. No silent fail-open vulnerabilities. Every permission decision is logged with the resolver outcome.
Each tenant has its own role and permission namespace. A user who is an admin in Tenant A has zero elevated access in Tenant B. Enforced at the DB query level, not just the API.
The 5-minute permission cache uses in-memory storage by default. Swap to Redis with one config line for distributed deployments where multiple API instances share session state.
Programmatically grant, revoke, and check permissions via the internal API. Automate onboarding flows — assign roles on user creation, update on subscription tier change.
TenantId is a first-class citizen at every layer. It is not a filter you add later — it is a structural constraint baked into the data model, API contracts, and UI rendering.
IAM is not a place to cut corners. Passport is built on engineering fundamentals that make security properties provable, not hopeful.
Tests cover authentication flows, permission resolution, tenant isolation, token lifecycle, and every critical path. 95% pass rate. Remaining 5% are in-progress compliance edge cases.
All passwords are stored as bcrypt hashes with configurable cost factor. Plain-text passwords never touch the database. Password comparison is always timing-safe.
Anti-CSRF tokens on all state-mutating endpoints. Token rotation on session elevation. SameSite cookie policy enforced. Tested against standard OWASP CSRF attack patterns.
Per-user, per-IP, and per-tenant rate limits on authentication endpoints. Sliding window algorithm. Configurable limits per environment. Redis-backed for distributed deployments.
Clean Architecture throughout: presentation, application, domain, and infrastructure layers are strictly separated. Every dependency points inward. Easy to extend, safe to change.
70% deployment-ready. Enterprise compliance controls (SOC2 Type II, HIPAA BAA support) in active development. GDPR data export and deletion tooling included in current release.
Open standards coverage for every integration your customers will ask for.
Modern, standard, easy to hire for. No exotic dependencies — just well-understood technologies used correctly.
Talk to us about licensing Passport for your platform. Deploy in 1–2 weeks.