IDMatrix
A self-hosted identity domain for Linux, with a one-way trust to your existing Windows AD so AD accounts log in to Linux unchanged.
What it is
IDMatrix is a self-hosted identity domain built on FreeIPA: LDAP directory, Kerberos KDC, built-in CA, optional DNS, and a management console. It replaces per-host account management. Once a Linux host joins the domain, users, SSH keys, sudo rules and host access control are configured in one place and apply everywhere.
Environments that already run Windows AD do not migrate accounts. IDMatrix establishes a one-way trust to the AD forest; AD users log in to Linux with their existing credentials, and Linux-side access control is applied by AD group.
Not in the picture: with several masters every server holds a full copy (LDAP multi-master replication) and clients find a live one through DNS SRV records; the licence gate intercepts administrative writes only, client authentication never passes through it.
What it does
| Capability | Notes | Licence |
|---|---|---|
| Users, hosts, groups, sudo, RBAC, OTP | Core directory and Kerberos objects, multi-master replication, backup and restore | All tiers |
| Host-based access control (HBAC) | Who may log in from where to which host, by host group and user group | Standard and up |
| Password policies | Length, history, lockout, per group | Standard and up |
| User SSH key management | Public keys in the directory; sshd looks them up, no more per-host authorized_keys | Standard and up |
| Certificate issuance | Built-in CA issues and auto-renews host and service certificates | All tiers |
| Built-in DNS | Domain A / PTR / SRV records maintained automatically, forwarding upstream | Professional and up |
| Automount | NFS home directories and shares via automount maps | Professional and up |
| Certificate identity mapping | Smart card / client certificate login, lightweight sub-CAs | Professional and up |
| Kerberos ticket policy | Ticket lifetime and renewal limits | Professional and up |
| AD trust | One-way trust to an AD forest; AD users log in to Linux | Enterprise |
Licensing is by feature module and managed host count, not by user. Tiers are defined under Licence. Before activation the console is read-only.
Where to start
Quick start
From the delivery bundle to a working console in about thirty minutes.
Installation
Host requirements, ports, the three DNS layouts, AD trust prerequisites, licence, adding a second server, upgrade and backup.
User guide
What each console page is for and where its limits are.
Troubleshooting
Find the cause by symptom; licence and install error codes.