One sign-in for your people, devices and apps.
Prismara Identity signs your people in to Windows and Linux devices, every Prismara app and your own applications, with passkeys first and post-quantum signed tokens by default. Each app decides who may use it and how strongly they must sign in, and groups keep themselves up to date from user attributes. Built from scratch in Rust, it can replace Microsoft Entra ID or run alongside it.
What Prismara Identity does
Single sign-on
Authorization code with PKCE, refresh-token rotation with theft detection, client credentials and back-channel logout for every connected app.
Application access control
Each app and API has its own roles, privileged by default. Assignment is required, and each app sets a minimum sign-in strength, with step-up when a stronger factor is needed.
APIs and delegated scopes
Register APIs with their own audiences and delegated scopes, and give services client-credential access by app role rather than blanket secrets.
Dynamic groups
Membership rules on attributes such as department, title or office, applied within seconds, with a preview before you save.
Windows and Linux sign-in
A Windows credential provider for logon, unlock and UAC prompts, and Linux sign-in through PAM and NSS with offline sign-in for up to 14 days.
Passwordless by default
Passkeys and FIDO2 security keys are the primary factor, TOTP the fallback. New people get a single-use pass that can only enrol a passkey.
User provisioning
Users and groups flow to Prismara Mail and the other apps over SCIM 2.0. Leavers are deactivated everywhere, never silently deleted.
Partner-ready tokens
Published test vectors let partners and third-party apps verify hybrid post-quantum tokens correctly.
How it's secured
Prismara Identity follows the engineering rules shared across the suite, plus these product-specific measures.
Attributes can't grant admin
Dynamic groups are never privileged and never sent to devices, so an HR attribute can't make someone a local administrator.
Post-quantum by default
Tokens use hybrid ML-DSA-65 signatures and connections use TLS 1.3 with X25519MLKEM768. Classical-only devices are refused.
Privileged accounts protected
Provisioning tokens cannot touch administrators, roles or privileged groups, and access passes cannot be issued for administrators.
Tenant isolation and audit
Every tenant is separated with forced PostgreSQL row-level security, and every change lands in a hash-chained audit log.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.