Issuerd live demo

A public, isolated IAM playground built from main@cd62310fce52. Try real OIDC/OAuth2 flows, passwordless email login, TOTP, LDAP federation, token attenuation, DPoP and CIBA step-up approval.

Synthetic data only. This is not a production service. Availability and state are best-effort; scenarios may be reset. Do not use real passwords or sensitive data. Public demo accounts are intentionally listed below; the Issuerd master admin and directory admin accounts use separate private credentials.

Shared password for the public demo users below: Demo-gXodnZ6Gj6LVaQxM2y6WSn0x

Use it with alice or bob in App 8, demo in App 3/App 9, alice in My Realm, and testuser/testuser2 in directory scenarios. testuser has the developer role; testuser2 intentionally does not.

Identity provider

Issuerd admin console owner

Full administrative UI. Publicly reachable by design, protected by a separate strong admin password; MFA is a planned follow-up.

Open admin console

Account console

Self-service profile, credentials, sessions and consents in myrealm. Sign in as alice with the public demo password.

Open account console

OIDC discovery

Live machine-readable capability metadata from the same build that serves every scenario.

Open discovery JSON

Authentication and authorization scenarios

App 1 · Password + profile

Self-registration with mandatory names, email verification, password login and role-gated pages. Use your own email address.

Start App 1

App 2 · Passwordless email code

Self-registration without a password, verified email and a single-use six-digit login code. Use your own email address.

Start App 2

App 3 · Admin-provisioned password

No self-registration. Sign in as demo with the public demo password and explore authenticated and developer-only pages.

Start App 3

App 4 · Admin-provisioned email code

No self-registration or password. The provisioned demo user requests a code delivered to the demo operations mailbox (owner-only), exercising real SMTP end to end.

Start App 4

App 5 · AD LDAP + group sync

AD-style LDAP bind and group-driven authorization. This public VM uses a dedicated Samba AD backend instead of the private lab's Windows AD; the scenario remains explicit about that substitution.

Start App 5

App 6 · Samba AD DC

A separate Samba AD domain with testuser and testuser2, demonstrating LDAP login and developers group synchronization.

Start App 6

App 7 · OpenLDAP

Generic LDAP schema, memberOf-based group mapping and the same role-gated application flow.

Start App 7

App 9 · TOTP authenticator

Sign in as demo, scan the enrollment QR with any TOTP authenticator, then use the six-digit second factor on subsequent logins.

Start App 9

App 10 · LLDAP federation

LLDAP-backed identities, attribute mapping and group synchronization. Use the directory demo users, not the LLDAP admin account.

Start App 10

LLDAP console owner

Directory administration UI with a separate private admin password. Its LDAP listener itself is never exposed publicly.

Open LLDAP console

Agentic IAM

App 8 · MCP + DPoP + CIBA

Chat with a deterministic agent. It exchanges user tokens for narrow audience/scope, binds them to a DPoP key, enforces PostgreSQL row-level security, and asks for human approval before a high-value refund. Sign in as alice or bob. The MCP server remains internal-only.

Start the agentic demo