Everyone rebuilds it, badly
Every product needs users, roles, and permissions. Teams rebuild the same tables, the same resolution logic, and the same admin screens — and each rebuild ships its own bugs.
Access control your app deserves, without building it
A drop-in IAM module for Spring Boot & React — feature, action, and field-level permissions, multi-tenant from day one, running in minutes.
The problem
Section titled “The problem”Role checks aren't enough
hasRole("ADMIN") can’t express “loan officers may approve loans but never see the SSN
field.” Real products need feature, action, and field-level decisions — with DENY
winning conflicts.
The frontend lies
Hiding a button is not access control. If the backend isn’t the single source of truth,
every hidden feature is one curl away.
Why IAM
Section titled “Why IAM”Three-tier permissions
Feature access → action rights → field visibility, resolved in one call. DENY always beats ALLOW; no permission means no access.
Minutes to running
One starter dependency, two lines of yml, dev-mode: true. Migrations run, a tenant and
admin are seeded, and your @RequiresPermission annotations auto-register your resources.
Pluggable everything
Cache: memory, Redis, or off. Database: PostgreSQL or MySQL. Tenancy: row-level, schema-per-tenant, or database-per-tenant. Every choice is a config value with a safe default — every default overridable with your own bean.
Backend is the source of truth
The React library renders what the backend permits — FeatureGuard, ActionGuard,
FieldGuard — but enforcement always lives server-side.
One line of config, one annotation
Section titled “One line of config, one annotation”iam: dev-mode: true # local dev: secrets auto-generated@GetMapping("/loans")@RequiresPermission(resource = "loans", action = "read")fun list(): List<LoanDto> = loanService.findAll()That annotation doesn’t just protect the endpoint — at startup it registers the loans
resource and its read action, ready for permission assignment in the admin UI.
What’s in the box
Section titled “What’s in the box”Backend
Spring Boot 3 starter (Kotlin): JWT auth, OAuth2/OIDC login, 2FA, password reset, rate limiting, audit trail, scoped RBAC, Flyway migrations, OpenAPI.
Frontend
@mpofusindie/iam-react: provider, hooks, and guard components. Plus a standalone admin
dashboard for users, roles, groups, and the permission matrix.