OpenIAM is an identity and access management vendor that helps mid to large and regulated enterprises govern who has access to what. One platform runs the workforce identity lifecycle, access management and customer identity, so organisations can replace separate provisioning, review and sign-on tools.
The same governance model now covers machine identities and AI agents, so organisations can hold every account, human or not, to one standard of ownership and approval.
At A Glance
| Vendor | OpenIAM, New York, United States |
|---|---|
| Category | Identity governance and administration, access management and CIAM |
| Identities covered | Workforce users, customers, contractors, service accounts, API keys, bots, certificates, cloud workloads, AI agents |
| Deployment | Self-hosted on premises or in the cloud (RPM, Docker Swarm, Kubernetes, OpenShift) |
| Agentic AI | MCP server, SelfService AI assistant, AI agent records in the NHI inventory |
| Founded | 2008 |
| Market classification | Identity Governance & Administration; also Workforce IAM |
What OpenIAM Does
Identity programmes in large organisations tend to stall between policy and practice. Separate tools for provisioning, access reviews and sign-on each hold part of the picture, and the gaps between them are where orphaned accounts and unreviewed access accumulate.
OpenIAM’s approach is to put governance, access management and customer identity on one shared provisioning engine, so a single record of each identity drives every decision, and to give regulated enterprises something they can run themselves, with a reported deployment time of as little as 90 days.
Products
Workforce Identity
Workforce Identity covers the employee and contractor lifecycle for IT and compliance teams. It automates onboarding and offboarding, routes access requests through approval workflows, runs user access reviews and enforces segregation of duties. It also provides SSO and MFA, including FIDO 2, push authenticator and PIV, plus contractor and consent management.
Customer Identity (CIAM)
Organisations that run consumer-facing services need sign-in that customers will actually use. The CIAM offering gives those services passwordless authentication and single sign-on on the same platform that governs staff, so customers reach digital services without managing passwords.
Non-Human Identities
A redesigned area of the Webconsole gives security teams one inventory of machine and agent identities, where each entry has a named human owner, a declared purpose, an expiry date and a health score. It handles eight NHI types, from service accounts to AI agents. New entries pass an approval workflow before activation and then follow a status lifecycle with an audit trail, while policies control who may register, activate or change an NHI.
How It Works
OpenIAM runs as “a set of application services that communicate over a message broker”, packaged as systemd units on RPM installations or as separate workloads on Kubernetes, with Terraform scripts and Helm charts for automated deployment.
| Component | What it does |
|---|---|
| ESB | The core identity and access service for users, logins, roles, policies and authentication. |
| auth-manager | Maintains and evaluates the entitlement graph. |
| idm | The provisioning pipeline that orchestrates operations on target systems. |
| workflow | The approval engine, built on Activiti. |
| Synchronisation and reconciliation | Pulls identity data from authoritative sources and detects drift against managed systems. |
| Infrastructure | A relational database as system of record, RabbitMQ, Redis, OpenSearch for search and audit, a graph store (JanusGraph over Cassandra or a managed service), HashiCorp Vault with Consul, and Apache httpd as the Access Gateway. |
Identities And Systems Covered
| Workforce users | Employees and contractors |
|---|---|
| Customers | Consumer identities through the CIAM offering |
| Non-human identities | Service accounts, API keys and tokens, CI/CD pipelines, RPA bots, certificates and PKI, cloud workloads, AI agents and workforce-spawned credentials |
| Directories | Microsoft Active Directory, Azure Active Directory, LDAP (OpenLDAP, eDirectory, OpenDJ, Okta Directory, RACF Directory), Redhat IPA |
| Cloud and SaaS | Amazon AWS, Microsoft Azure Cloud, Google GSuite, Salesforce.com, ServiceNow, Workday |
Agentic AI Capabilities
MCP Server
The OpenIAM MCP server lets an AI assistant answer questions from OpenIAM data on behalf of the person using it. The user signs in through OAuth 2.0 and the assistant acts as that user, subject to the same checks as Webconsole and SelfService. Claude.ai and Claude Code are documented clients, and the server is read only.
Tool Call Policies
Each MCP tool call can be a policy decision that narrows what a person or agent may call and masks what comes back. Seven policies ship with the product.
AI Agents As Non-Human Identities
Every MCP client gets an agent record in the NHI inventory, with a named sponsor and one-action suspension. An AI agent can be bound to the OAuth client of the assistant using the MCP server. SelfService also has a built-in AI assistant that uses the same route.
Integrations
| Area | Integrations |
|---|---|
| Microsoft | Office365, Exchange Online and on-premises, SQL Server, Azure DevOps, Windows Server, PowerShell |
| Oracle and SAP | Oracle Database, Oracle EBS, Oracle IDCS, SAP HR, SAP S/4 Hana, SAP SuccessFactors |
| SaaS | Box.net, Docker Hub, FreshWorks, FreshService |
| On-premises | Atlassian JIRA, Linux, relational databases, Tableau |
| Source only and multi-purpose | ADP, CSV, Oracle HR, REXX, SCIM, Groovy script |
| Authentication | Criipto |
Company Background
| Founded | 2008, with the whole stack built in-house since then |
|---|---|
| Headquarters | New York, United States |
| Leadership | Ameet Shah, Chief Marketing Officer |
Note: This overview is compiled from OpenIAM’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.