Wren:IDM

Wren:IDM is a community‐developed identity management system with a flexible data model, multiple extension points and scripting support, including JavaScript and Groovy. It can connect to and manage a wide range of systems through the Identity Connector Framework (Wren:ICF).

Wren:IDM is one of the projects in the Wren Security Suite, a community initiative that adopted open‐source projects formerly developed by ForgeRock, which has its own roots in Sun Microsystems’ products.

Wren:IDM itself is focused on identity management processes and it also provides a powerful framework for implementing IAG and a portion of IAM processes as well. Although the project is based on OpenIDM code, it is not affiliated with ForgeRock in any way. It is based on the very latest code available under a CDDL license (not‐yet‐released OpenIDM 5.x).

The features of Wren:IDM include:

• A complete platform for building IDM and IG solutions using the concepts described below – roles, mappings, synchronizations, workflows, policies, etc.
• ICF Connector Servers – services that allow connectors to be run outside of the IDM itself. Useful when a connector needs a specific client environment to talk to the integrated system. Also facilitates security. .NET and Java Connector Servers are available.
• Administration GUI – an interface for making changes to data models and configuration using a point‐and‐click interface rather than Wren:IDM's REST interface.
• Self‐service GUI – an interface for end‐users to update their profile information, passwords, and preferences.

Both the Administration GUI and Self‐Service GUI are web‐based, single‐page applications that can be turned off in deployments that do not desire to use them [1].

Contributions

Getting the Wren:IDM application

You can get Wren:IDM application in couple of ways:

Download binary release

The easiest way to get the Wren:IDM is to download the latest binary release.

Build the source code

In order to build the project from the command line follow these steps:

Prepare your Environment

Following software is needed to build the project:

Software	Required Version
OpenJDK	17 and above
Git	2.0 and above
Maven	3.9 and above

Build the source code

All project dependencies are hosted in JFrog repository and managed by Maven, so to build the project simply execute Maven package goal.

$ cd $GIT_REPOSITORIES/wrenidm
$ mvn clean package

Built binary can be found in ${GIT_REPOSITORIES}/wrenidm/openidm-zip/target/wrenidm-${VERSION}.zip.

Docker image

You can also run Wren:IDM in a Docker container. Official Wren:IDM Docker images can be found here.

Software Bill of Materials (SBOM)

Each release provides CycloneDX SBOMs signed as GitHub artifact attestations. The attestations can be verified with GitHub CLI. In the examples below, set VERSION to the release version (e.g. export VERSION=7.2.0).

Maven dependencies

The SBOM of the Maven dependencies (sbom-source-deps.cdx.json) is attached to the GitHub release and as an attestation to the binary release (wrenidm-${VERSION}.zip). Download the ZIP from the GitHub release, verify the attestation and save the signed SBOM with:

$ gh attestation verify wrenidm-${VERSION}.zip \
    -R WrenSecurity/wrenidm \
    --predicate-type https://cyclonedx.org/bom \
    --format json --jq '.[0].verificationResult.statement.predicate' \
    > sbom-source-deps.cdx.json

Docker image

The SBOMs of the Docker image are attached as attestations to each platform-specific image (linux/amd64 and linux/arm64). The attestations are stored in GitHub and in Docker Hub.

The following example is for the linux/amd64 image. First, get the digest of the platform-specific image:

$ PLATFORM_DIGEST=$(docker buildx imagetools inspect wrensecurity/wrenidm:${VERSION} --raw \
    | jq -r '.manifests[] | select(.platform.os == "linux" and .platform.architecture == "amd64") | .digest')

Then verify the attestation and save the signed SBOM with:

$ gh attestation verify \
    oci://docker.io/wrensecurity/wrenidm@${PLATFORM_DIGEST} \
    -R WrenSecurity/wrenidm \
    --predicate-type https://cyclonedx.org/bom \
    --format json --jq '.[0].verificationResult.statement.predicate' \
    > sbom-docker-image-amd64.cdx.json

The command fails if the attestation cannot be verified. Add --bundle-from-oci to fetch the attestation from Docker Hub instead of GitHub.

Documentation

Project documentation can be found in our documentation platform (docs.wrensecurity.org). Repository hosting cookbook with common use cases is available on GitHub.

Acknowledgments

Large portions of the source code are based on the open-source projects previously released by:

• Sun Microsystems
• ForgeRock

We'd like to thank them for supporting the idea of open-source software.

Disclaimer

Please note that the acknowledged parties are not affiliated with this project. Their trade names, product names and trademarks should not be used to refer to the Wren Security products, as it might be considered an unfair commercial practice.

Wren Security is open source and always will be.

Bibliogprahy

[1] SCHWARTZ, Michael, Maciej MACHULAK. Securing the Perimeter: Deploying Identity and Access Management with Free Open Source Software. Apress, 2018. ISBN 978-1-4842-2601-8.