Skip to content

HelixIAM

HelixIAM is the complete identity & access management platform for modern applications — a multi-tenant OpenID Connect and SAML 2.0 identity provider with strong authentication, federation, EU electronic IDs, provisioning, and a full admin & end-user console. It secures human, machine, and AI-agent identities alike: first-class non-human identities (NHI) with an accountable owner, a lifecycle kill-switch, and on-behalf-of delegation for agents acting for users. Secure every app with enterprise single sign-on, run it on your own infrastructure, and own your identity layer end to end.

  • Get started

    Try it in one command, then install for real with Docker Compose or Helm.

    Getting started

  • Manage

    Realms, applications, users, roles, scopes & claims, groups, organizations.

    Manage

  • Authenticate

    The flow editor, MFA, passkeys, device push, and risk-based step-up.

    Authentication

  • Federate

    OIDC / SAML / LDAP / social brokers, DigiD, eHerkenning and eIDAS, and the EU Digital Identity Wallet (Beta; Digital Credentials API, verify-only and the decentralised-identity features are Preview).

    Federation & eIDs

  • Integrate

    SDKs, Terraform, SCIM, webhooks, the API reference and the account console.

    Integration

  • Operate

    Keys, theming, RBAC, GDPR, observability, backup/DR and hardening.

    Operations

What Helix does

Capability
Protocols OAuth 2.1 / OpenID Connect (authorization code + PKCE, client credentials, refresh, device, CIBA), SAML 2.0 IdP, FAPI (mTLS-bound tokens, signed request objects, JARM), DPoP, PAR
Authentication Data-driven flow engine; password policy + breach check + lockout; TOTP, SMS/email OTP; WebAuthn passkeys; device push with number matching; transaction signing (WYSIWYS)
Federation OIDC, SAML, LDAP/AD and social brokers with JIT provisioning, account linking, and mappers in both directions: upstream claims and attributes to user attributes and roles, and user attributes and roles to SAML attributes
EU eIDs DigiD (NL citizen), eHerkenning (NL business), eIDAS (EU cross-border) connectors; sign-in with an EU Digital Identity Wallet through an OpenID4VP verifier (Beta; Digital Credentials API and verify-only are Preview), with issuer trust from signed EU trusted lists; the BSN stored encrypted per realm, masked in the console and released only to applications a realm-admin opts in
Decentralised identity (Preview, not yet tested with a real national wallet) Wallet step-up without signing in again, with a lifetime, attribute matching and verified attributes kept on the profile; Credentials beyond the PID (driving licence, diploma, qualification) with per-credential trust and claims-to-roles mappers; credential issuance over OpenID4VCI (SD-JWT VC and mdoc, status-list revocation); verified data for applications as OIDC verified_claims; a verification API to prove attributes without a sign-in; transaction confirmation with the wallet; DIDs (did:jwk, did:key, did:web) for ecosystems outside the EUDI framework
AI agents / NHI First-class agent identities with an accountable owner, lifecycle kill-switch, nhi token claims, least-privilege roles, and RFC 8693 on-behalf-of delegation (effective roles = user ∩ agent leash ∩ scope)
Workload identity Keyless token exchange for Kubernetes/CI workloads (federated JWTs, no stored secret)
Multi-tenant Realms isolate users, agents, clients, keys, flows and branding; each realm is its own OIDC issuer and SAML 2.0 IdP
Provisioning SCIM 2.0 (in and out), LDAP sync, bulk import, Dynamic Client Registration
Authorization Realm & client roles, hierarchical groups, UMA 2.0 authorization services (resources / policies / permissions), and resource indicators (RFC 8707)
B2B Organizations — member companies with their own domains and identity providers inside a realm
Operations Per-realm key management & rotation (bring your own key and certificate, ES256, CSR, staged activation), audit log + SIEM, outbound webhooks, admin RBAC, GDPR tools, data retention, database TLS, Prometheus metrics & health, high availability without Redis
Consoles A React admin console and a self-service end-user account console

How it's built

Helix ships as two independent images that scale separately:

  • helix-iam-server — OAuth2 / OIDC / SAML endpoints, the sign-in pages, the admin REST API, the identity domain and the end-user account console (/realms/{realm}/account), owning one PostgreSQL database directly. No message broker. It runs as n replicas, stateless across replicas: sessions, tokens, flow state and rate limits live in PostgreSQL (or, optionally, Redis), so any replica answers any request.
  • Admin console (helix-dashboard) — the operator UI, an nginx image with its own Helm Deployment, replica count, HPA and ingress. It proxies the admin API to the server, holds no state, and can run internal-only on its own "beheer" host.

See Architecture.

Licence

HelixIAM is commercial, proprietary software from KubeDNA B.V. For a licence, a demo or pricing, contact KubeDNA B.V. at [email protected]. See Licensing.

New here?

Start with the Quickstart to get a working instance in one command, then read Core concepts to learn the vocabulary (realms, applications, clients, flows) the rest of the docs use.