OmniTrust Identity
Identity & Access · Available · v1.0
OmniTrust Identity is the sovereign Customer and Workforce IAM for South African estates, campuses and municipalities. Built on OpenIddict, it provides 15+ MFA providers (TOTP, SMS OTP/magic-link, missed-call, Telegram, email OTP, FIDO2/Passkey, Windows Hello, SSH keys, CompreFace face, Tiqr, YubiKey and carrier Verify shims), a single hierarchy engine governing MFA, notifications and account-security policy (system → role → tenant → solution → group-type → group → entity → user), nested-group RBAC, user-owned vault and a billing plane with PayFast. Machine M2M via client_credentials powers gates, runners and sentinels without human OTP.
Business problem
Foreign per-MAU IAM rents personal data offshore and cannot model estate/mine/municipality hierarchies. SIM-swap, SMS scam and account hijack exploit telecom OTP and central honeypots.
Core capabilities
- ▸OpenID Connect / OAuth2 IdP (OpenIddict)
- ▸15+ MFA providers with hierarchical policy
- ▸Hierarchical account-security policy (lockout, verification, session, password age)
- ▸Nested-group RBAC + tenant isolation via EF global filters
- ▸User-owned vault — values client-encrypted, only schemas/receipts server-side
- ▸Notification mesh: WhatsApp/Telegram/SMS/Email via 23 provider deployments
- ▸Billing plane with PayFast + subscription metering
- ▸Machine M2M (client_credentials) for gates/runners/sentinels
Architecture
Microservice IdP with Npgsql + Redis, global tenant filters, Eureka Ed25519 capability tokens, CSRF/rate-limit via Redis, hot-swappable IdP stance. All personal data as sealed blobs owned by the client domain; no central honeypot.
Deployment: Self-hosted on Coolify (single-node) with Postgres + Redis; SA-region cloud. No foreign scrubbing centre.
Licensing: Subscription per tenant/seat + PAYG metering; 85%+ gross margin on containerised density.
Evidence & confidence
Confidence: high
- MOBISEC-Portfolio-Executive-Summary.md §1 (Production)
- PRODUCTION-READINESS-GAP-ANALYSIS.md 2026-09-30 pass
- OmniTrust-Identity.sln 40+ csproj, OpenIddict, audit docs
At a glance
- Platforms
- Web (Blazor) · Android / MAUI · API / M2M
- Stack
- .NET 10 / OpenIddict 7.4 · PostgreSQL + Redis · GraphQL + REST · MQTTnet · Docker / Coolify · PayFast ITN
- Integrations
- OmniVisit · OmniAccess · OmniYard · OmniQueue · OmniQuip · OmniIdv · Eureka · PayFast · CompreFace · Tiqr · YubiKey
- Maturity
- Production (high confidence)
Target customers
- · Residential estates and compounds
- · Mining and industrial campuses
- · Municipalities and schools
- · SaaS operators needing POPIA residency on SA tin
Roadmap
Continuous MFA provider expansion, FICA/RICA Level 2-3 hardening, LAWtrust AeSign bridge for suretyship-grade signing.