Cerberus

Cerberus is an identity governance and administration (IGA) platform built for multi-tenant organisations. It covers the full identity lifecycle —onboarding, group membership, organisation hierarchy and offboarding—, privileged access management with time-bound elevation and approval, access governance with separation of duties and certification campaigns, and federation with the surrounding ecosystem through OIDC, SAML 2.0 and SCIM 2.0. It is where the two halves of my work meet: the corporate identity I have operated in Active Directory and Entra ID, and the platform architecture that holds it up.

What it does

It answers the three questions an auditor always asks: who has access to what, who approved it, and when does it expire.

• Manages the user lifecycle with roles, group membership and organisation hierarchy.
• Authenticates with a second factor through TOTP and WebAuthn (FIDO2), with configurable enforcement.
• Federates identity as an OpenID Connect provider and a SAML 2.0 service provider, with SCIM 2.0 provisioning.
• Elevates privileges just in time: who can activate which role, for how long and with what approval, expiring automatically.
• Detects separation-of-duties conflicts in real time and runs periodic access certification campaigns.
• Models approvals as DAG flows with seven node types, resolved by topological order with parallel branches.
• Scores risk per user, discovers orphan accounts across connected systems and classifies security anomalies.

Architecture

The platform is modular by design: the gateway discovers each plugin route dynamically, and the contracts between services are defined before the code.

• A .NET 10 backend with clean architecture and DDD, CQRS over MediatR and declarative validation.
• A YARP gateway with dynamic per-plugin route discovery, so adding a module does not mean touching the routing.
• Contract-first communication with Protocol Buffers over gRPC and Connect-RPC, plus SignalR for what happens live.
• PostgreSQL 16 with nine schemas and row-level security, accessed through Entity Framework Core.
• An outbox pattern implemented with Debezium change data capture over Kafka-compatible Redpanda.
• Privileged account credentials kept in HashiCorp Vault, never in the product database.
• Federated search over OpenSearch across users, organisations, groups, roles and applications.
• An AI orchestrator that masks personal data before it reaches the model, with a per-tenant token quota.

Stack

A C# backend on .NET 10 with clean architecture, DDD and CQRS; a YARP gateway; contracts in Protocol Buffers over gRPC and Connect-RPC; PostgreSQL 16 with row-level security and Entity Framework Core; Redpanda with Debezium for the outbox; Redis 7 for cache, sessions and backplane; OpenSearch 2 for search; HashiCorp Vault for secrets; and a Next.js 16 frontend with React 19, Radix UI and Tailwind, trilingual in Spanish, English and Catalan.