Grantra
v0.3 is out · now with privileged access

Know who has access to what, why, and until when.

Grantra is open-source identity security: it governs access as people join, move and leave, signs them in with MFA, and hands out privileged access just in time, recorded. One self-hosted platform instead of separate SailPoint, Okta and CyberArk bills.

Try it in 5 minutes Star on GitHub
The Grantra console home page, with shortcuts to My access, Request access, Approvals, Access reviews, People, Administration and the Audit log
Identity governance Who should have access Joiner, mover, leaver, requests, reviews and separation of duties. Access management How people sign in Grantra Login with MFA, passkeys and federation, or keep your own IdP. Privileged access Admin rights, only when needed Vault, just-in-time access and recorded sessions to servers, databases and clouds.

Identity governance

Access that follows people, without the six-month rollout

Joiner, mover, leaver

Reads people from your HR source and gives or removes access on their start and end dates. A dry run shows what changes, and a brake refuses a sync that would remove too many people at once.

Access requests

People ask for a role or entitlement from the catalog. Their manager, then the application owner, approves it, optionally until a date. Emails tell everyone when it is their turn.

Access reviews

Campaigns where managers or owners keep or revoke the access their people hold, with deadlines and reminders. Revoked access goes away.

Separation of duties

Policies such as "nobody both creates and approves payments", detected every 30 minutes or stopped at request time, with time-boxed exceptions an admin signs off.

Connectors

SCIM, LDAP / Active Directory and Grantra Login. Grantra reads accounts, links them to people, flags orphans, and can provision changes back, off by default and with a dry run.

Audit log

Every change and decision, with who made it and why, searchable from the console and ready for your auditors.

Built for the people who approve, not just admins

One web app for employees, managers, application owners, auditors and admins. Each person sees what they need to do, and nothing they shouldn't.

Approvers get an inbox with the reason, the risk and the deadline, so saying yes or no takes seconds instead of a ticket.

A manager's approvals inbox with an access request to GitHub Org admins, its reason and its deadline

Access management

Sign-in included, or bring the one you have

Keep Entra ID, Okta or Keycloak and let Grantra govern on top. No identity provider yet, or want to leave one? Grantra Login, a Keycloak managed from the Grantra console, ships with it.

MFA and passkeys

Ask for a second factor from everyone, or only from people who hold sensitive access. Grantra keeps that list up to date as access changes.

Federation and gradual migration

People sign in with Entra ID, Okta, or any OpenID Connect or SAML provider. Move one email domain at a time, and import users and apps from another Keycloak after a dry run.

Authorization for your apps

Your apps ask Grantra whether someone may do something, and Cedar policies answer with the person's roles, manager and entitlements. Leavers are always denied.

Privileged access

No standing admin rights

Admin access is something people activate for a few hours with a reason, not something they keep. When it ends, Grantra takes it back on its own.

  • Credential vault for privileged passwords and SSH keys, rotated after each use, with the master key in your KMS or HSM
  • Just-in-time access with approval, and a report that turns standing admin rights into eligibility in one click
  • Recorded sessions to SSH servers, PostgreSQL, MySQL, Kubernetes and Windows desktops in the browser, played back and searchable
  • Cloud consoles for AWS, Azure and Google Cloud, with roles granted for the session and removed after
  • Break glass for emergencies: every admin is told, the password rotates, and someone reviews each use
marta@laptop
# 1. In My access: activate "prod-api" for 2 hours, with a reason
# 2. In Servers: Get certificate, valid until the access ends

$ ssh -p 2222 prod-api@ssh.example.com
# the gateway checks the access and records everything
deploy@prod-api:~$ sudo systemctl restart api
deploy@prod-api:~$ exit

# 2 hours later the access ends and any open session closes

Ready for your own infrastructure

  • Helm chart for Kubernetes, any number of replicas
  • PostgreSQL with row-level security per tenant
  • OpenTelemetry traces, metrics and logs, plus a Grafana dashboard
  • Releases signed with cosign and shipped with an SBOM
  • Authorization inside Grantra itself runs on Cedar policies
Separation of duties policies and an open violation, with a button to accept the risk

Try it in five minutes

All you need is Docker. The stack starts with a small sample company to play with.

git clone https://github.com/grantra-dev/grantra.git
cd grantra
make up

Open http://localhost:8080 and sign in as admin / admin, or as a sample employee such as marta with the password demo. The demo guide walks through a new hire, an approval, an access review and a leaver.

Where it's going

  1. Identity governance Available in v0.1
  2. Access management with Grantra Login: MFA, passkeys and federation Available in v0.2
  3. Privileged access: vault, just-in-time access, recorded sessions, cloud consoles Available in v0.3
  4. Identity threat detection and access recommendations Next

Questions

Is it really free?

Yes. Grantra is Apache 2.0: you can run it, change it and use it commercially. You host it on your own infrastructure.

Do I have to replace my identity provider?

No. Grantra governs access on top of Entra ID, Okta, Keycloak or Active Directory. Grantra Login is there if you want it, and you can move over one domain at a time.

Is it ready for production?

Grantra is young and versions before 1.0 may change behavior. It ships a Helm chart, observability and signed releases, and we recommend starting with a pilot. Report security issues as described in the security policy.