Description
An employee leaves, HR disables the AD account, and their logins in GitLab, Jira, the bastion host and three internal systems keep working. Without a single identity system this is near-inevitable, and it usually surfaces six months later during an audit. Apache Syncope exists to wire those systems together: change a person once and every connected system follows — onboarding, role changes and offboarding all run to completion on their own.
A top-level Apache Software Foundation project written in Java EE under the Apache 2.0 licence, it connects to LDAP, Active Directory, databases, REST endpoints and a long list of SaaS products. Administrators work in a web console; employees use a self-service portal to reset passwords, recover accounts and request access, with approval workflows configured alongside.
Identity lifecycle: creation, modification, suspension and deletion of users, groups and arbitrary custom object types, each step able to carry approvals and notifications.
External system sync: pull authoritative person data from an HR system, LDAP or a database, and push changes out to downstream applications, with bidirectional sync and conflict policies both configurable.
Realms and role trees: build a realm hierarchy matching the organisation, with roles that inherit and delegate, so a position like "regional sales lead" is defined once and reused.
Password and account policies: complexity, expiry, reuse history and lockout thresholds set per realm, with password changes propagated to every linked external system.
Self-service portal: staff reset their own passwords, run password recovery, self-register and request entitlements instead of filing an IT ticket each time.
Tasks and workflow: synchronisation, notification and bulk tasks run on a schedule, and approvals sit on the Flowable engine so multi-stage sign-off can be modelled properly.
Complete REST API: every administrative capability is exposed over JAX-RS for any language to call — the console itself is just another consumer of that API.
A top-level Apache Software Foundation project written in Java EE under the Apache 2.0 licence, it connects to LDAP, Active Directory, databases, REST endpoints and a long list of SaaS products. Administrators work in a web console; employees use a self-service portal to reset passwords, recover accounts and request access, with approval workflows configured alongside.
Features
Identity lifecycle: creation, modification, suspension and deletion of users, groups and arbitrary custom object types, each step able to carry approvals and notifications.
External system sync: pull authoritative person data from an HR system, LDAP or a database, and push changes out to downstream applications, with bidirectional sync and conflict policies both configurable.
Realms and role trees: build a realm hierarchy matching the organisation, with roles that inherit and delegate, so a position like "regional sales lead" is defined once and reused.
Password and account policies: complexity, expiry, reuse history and lockout thresholds set per realm, with password changes propagated to every linked external system.
Self-service portal: staff reset their own passwords, run password recovery, self-register and request entitlements instead of filing an IT ticket each time.
Tasks and workflow: synchronisation, notification and bulk tasks run on a schedule, and approvals sit on the Flowable engine so multi-stage sign-off can be modelled properly.
Complete REST API: every administrative capability is exposed over JAX-RS for any language to call — the console itself is just another consumer of that API.
