tpt-ms-ad

Memory-safe, air-gapped Active Directory replacement written in Rust. Drop-in LDAP v3 / Kerberos / OIDC / SAML identity layer with one-command AD migration.

Overview

tpt-ms-ad is a modern identity and access management system designed as a drop-in replacement for Microsoft Active Directory and Entra ID. It is the foundational identity layer of the TPT stack, but is fully functional as a standalone identity provider.

Core principles:

Sovereign by design — fully air-gapped, no telemetry, no external dependencies
Open standards — LDAP v3, Kerberos 5, OIDC 2.0, SAML 2.0, LDIF storage (RFC 2849)
Migration-first — one-command migration from AD; bi-directional sync during transition
Memory-safe — written in Rust; no buffer overflows, no use-after-free
High performance — 100,000+ authentications/second on a single node

Status

Design phase. See spec.txt for the full design specification and todo.md for the implementation roadmap.

Workspace Crates

Crate	Description
`tpt-ms-ad-core`	Authentication, authorisation, user/group/OU lifecycle, LDIF storage
`tpt-ms-ad-ldap`	LDAP v3 server (bind, search, modify, paged results)
`tpt-ms-ad-crypto`	Argon2id hashing, TLS certificates, HSM/PKCS#11 key management
`tpt-ms-ad-policy`	GPO-to-OPA policy translation, device posture, conditional access
`tpt-ms-ad-federation`	SAML 2.0 IdP/SP, OIDC provider and relying party
`tpt-ms-ad-events`	Domain event bus (embedded default; NATS feature flag)
`tpt-ms-ad-api`	Internal GraphQL API for the TPT mesh
`tpt-ms-ad-sdk`	Rust client SDK for external consumers
`tpt-ms-ad-web`	Admin web dashboard backend
`tpt-ms-ad-cli`	Admin CLI — user/group/OU management, migration, diagnostics

Quick Start

# (coming in v0.1)
cargo build --release -p tpt-ms-ad-cli
./target/release/tpt-ms-ad server start --data ./tpt-data/

# Create a user
tpt-ms-ad user create --name "Jane Doe" --sam jdoe --ou "OU=Engineering,DC=corp,DC=local"

# Migrate from Active Directory
tpt-ms-ad migrate from-ad --source ldap://dc01.corp.local --dry-run

License

Licensed under either of: