Skip to main content
Caradhras is the identity provider that Access Manager runs on. It is a self-hostable identity and access-management server. Caradhras holds the objects behind every access decision:
  • Organizations, the boundary that owns every other object.
  • Users, the people who sign in.
  • Groups and roles, the two ways to collect subjects.
  • Permissions, which pair a resource with an action.
  • Applications, the OAuth clients that machine-to-machine callers use.
  • Certificates, the key material behind token signatures.
You manage that data through the Identity APIs or Lerian Console.

​
Protocols

Caradhras supports these protocols and authentication methods:
  • OAuth 2.0 and OIDC
  • SAML 2.0
  • SCIM 2.0 for user provisioning
  • LDAP: authenticates users against an external directory. Caradhras does not run a directory.
  • WebAuthn and passkeys
  • MFA with an authenticator app (TOTP) or an email code

​
Authorization model

Caradhras expresses authorization with Casbin. A permission names a resource and an action. Access Manager evaluates that pair against the subject in the token before a product handler runs. Subjects nest. A group can belong to a parent group. A role can include other roles.

​
Your identity provider

Your identity provider connects to Caradhras as an upstream provider over OAuth 2.0 and OIDC, or LDAP. OIDC providers include Google, Microsoft Entra ID, Okta, or a custom OIDC provider. Your provider does not replace Caradhras. Your users then authenticate at your provider. Access Manager still reads their identity data from Caradhras, and it still decides what they can reach.

​
How it ships

Caradhras is part of the Access Manager deployment. You do not install it as a separate product. The Access Manager Helm chart deploys Caradhras as the identity backend, and the Auth and Identity services call it. Caradhras persists its identity data in the PostgreSQL database that you configure for Access Manager. Caradhras needs a license. Set LICENSE_KEY to a global license key, or set LICENSE_FILE_PATH to the path of a signed license file that Lerian issues. When LICENSE_FILE_PATH is set, Caradhras uses the file and ignores LICENSE_KEY. Without a license, or with a refused one, Caradhras does not start. While the license service does not answer, Caradhras is not ready. The database migration step needs the same license and stops if it cannot get one. With LICENSE_KEY, Caradhras and its migration step need outbound HTTPS to https://license.lerian.io. A failed renewal does not stop Caradhras. It stops when the license it holds reaches its stop time, or when the license is revoked. Read License Manager. To see what each Access Manager service uses the backend for, read Caradhras in Access Manager.