IDMatrix
A self-hosted identity domain for Linux, with a one-way trust to an existing Windows AD so AD accounts sign in to Linux unchanged.
Overview
IDMatrix is a self-hosted identity domain built on FreeIPA: LDAP directory, Kerberos KDC, built-in CA, optional DNS, and a management console. It replaces per-host account management. Once a Linux host joins the domain, users, SSH keys, sudo rules and host access control are configured in one place and apply everywhere.
Environments that already run Windows AD do not migrate accounts. IDMatrix establishes a one-way trust to the AD forest; AD users sign in to Linux with their existing credentials, and Linux-side access control is applied by AD group.
Boundaries not shown in the diagram: with several masters every server holds a full copy (LDAP multi-master replication) and clients find a live one through DNS SRV records; the licence gate intercepts administrative writes only, and client authentication never passes through it.
Capabilities
| Capability | Description | Licence |
|---|---|---|
| Users, hosts, groups, sudo, RBAC, OTP | Core directory and Kerberos objects, multi-master replication, backup and restore | All tiers |
| Host-based access control (HBAC) | Who may sign in from where to which host, by host group and user group | Professional and up |
| Password policies | Length, history, lockout, per group | Professional and up |
| User SSH key management | Public keys in the directory; sshd looks them up, with no per-host authorized_keys | Professional and up |
| Certificate issuance | Built-in CA issues and auto-renews host and service certificates | All tiers |
| Built-in DNS | Domain A, PTR and SRV records maintained automatically, forwarding upstream | Professional and up |
| Automount | NFS home directories and shares via automount maps | Professional and up |
| Certificate identity mapping | Smart card and client certificate sign-in, lightweight sub-CAs | Professional and up |
| Kerberos ticket policy | Ticket lifetime and renewal limits | Professional and up |
| AD trust | One-way trust to an AD forest; AD users sign in to Linux | Enterprise |
Licensing is by feature module and managed host count, not by user. Tiers are defined under Licence. Before activation the console is read-only.
Documentation
Quick start
From the delivery bundle to a working console in about thirty minutes.
Installation
Host requirements, ports, the three DNS layouts, AD trust prerequisites, licence, adding a second server, upgrade and backup.
User guide
What each console page is for and where its limits are.
Troubleshooting
Causes by symptom; licence and install error codes.