Operating Systems
for Identity

Preface

Building an Identity and Access Management (IAM) server from scratch is comparable to writing a kernel for a small operating system. Where an OS kernel manages memory, processes, and hardware access, an Identity Server manages principals, sessions, and authorization graphs.

Most contemporary web applications delegate login to third-party services such as Auth0, Clerk, or Cognito. These services are excellent for prototypes. But as a product matures into a platform — as it accumulates multi-tenant workspaces, custom auth policies, OIDC federation, fine-grained RBAC, and audit obligations — the rigid constraints of an external IAM begin to suffocate product development.

This book follows the construction of Rooiam, a fully custom, open-source IAM platform written in Rust (Actix-web), backed by PostgreSQLand Redis. Each chapter dissects one core problem of identity — from the most fundamental question of what is a user? all the way through OIDC federation, passkeys, security audit records, and workspace network policy.

Who This Book Is For

This book is written for software engineers at any level who want to understand identity systems from first principles. You do not need prior security experience. Each chapter builds on the previous one, introduces the theoretical problem before implementation details, and links to the corresponding Rust source. Examples are identified separately from executable source.

How Each Chapter Works

The chapters connect four aspects of identity systems:

1. The Problem — a clear, intuitive statement of the failure mode or attack that motivates the design.
2. Theory — the computer-science or cryptographic concept that solves the problem, explained from scratch.
3. Database Design — the PostgreSQL schema that encodes the solution durably and correctly.
4. Rust Implementation — a source-guided walkthrough of the relevantrooiam-server behavior and its limitations.

The implementation chapters include Exercises and source links. This edition follows package version 0.1.0 at commit c20b9ed (September 2026); the API path version remains v1.

The Stack at a Glance

Table of Contents

1. Chapter 1: The Core Database
2. Chapter 2: Magic Link Authentication
3. Chapter 3: Stateful Sessions
4. Chapter 4: Social Logins
5. Chapter 5: Multi-Tenant Architecture
6. Chapter 6: The OIDC Provider
7. Chapter 7: Threat Modeling
8. Chapter 8: Permissions & Roles
9. Chapter 9: MFA & Passkeys
10. Chapter 10: Audit Logs
11. Chapter 11: Machine Identity & API Keys
12. Chapter 12: Corporate Guardrails
13. Chapter 13: Operator Security Playbook