OpenCrowd — Feature Reference¶
Complete list of features implemented in the platform as of v0.1.0.
Core Modules¶
Identity Management (/identity)¶
- Full user CRUD (create, read, update, delete)
- User lifecycle states: Active, Disabled, Locked, Offboarded
- User profiles with Connected Accounts view (shows linked apps)
- Edit user email, name, department from profile page
- Multi-app user linking (tracks which apps each user is connected to)
- Source column shows which apps a user is connected to
- Pagination, search, and status filtering
Group Management (/groups)¶
- Static and dynamic groups
- Add/remove members with user picker
- Push to connected apps: adding a user to a group in OpenCrowd automatically pushes to the app(s) where that group exists
- Smart group push: only pushes to apps where the group is registered (prevents cross-app pollution)
- Group detail page with member list
Applications / Connectors (/applications)¶
- Register and manage connectors (xWiki, OpenProject)
- Connection wizard: URL + credentials + test connection
- Health check monitoring
- Manual sync and one-click resync using stored credentials
- Scheduled auto-sync every 30 minutes (both xWiki and OpenProject)
- Sync imports users, groups, memberships, and permissions
Access Matrix (/access-matrix)¶
- Unified cross-application permission view
- Filter by application (xWiki, OpenProject, or all)
- Permission columns per app (view, edit, admin, delete, comment)
- Toggle permissions: click to grant/revoke, automatically pushes to the target app
- Shows both USER and GROUP level permissions
- Source tracking (synced, manual, request)
Access Profiles (/access-profiles)¶
- Predefined permission templates (e.g., "Tempo Developer", "QF Quality Manager")
- Define which apps, groups, and permissions a role includes
- Link profiles during onboarding to auto-assign everything
- Used by the Joiner flow to provision new users with correct access
Access Requests (/requests and /request)¶
- Public request form accessible without login (
/request) - Multi-app selection: checkboxes for xWiki, OpenProject (not single dropdown)
- Dynamic Space/Resource dropdown: fetches real spaces from xWiki and projects from OpenProject
- Permission selection (view, comment, edit, delete, admin)
- Justification, project code, manager, and duration fields
- Request types: New Access, More Permissions, Temporary Access, Remove Access
- Admin approval workflow: Approve or Reject with comment
- On Approve:
- Auto-creates user in OpenCrowd if they don't exist
- Provisions user to the target app (creates account)
- Grants permission in Access Matrix
- Links user to the connected app
- Pending request count shown on dashboard
Joiner / Mover / Leaver (/lifecycle)¶
- Joiner (Onboard): Create user + assign profile + provision to apps + push groups
- Provision order: create user in app FIRST, then assign groups (prevents errors)
- Just-in-time provisioning: if user doesn't exist in OP when adding to a group, creates them automatically
- Leaver (Offboard): Set status to offboarded, revoke all access
- Disable: Soft-disable for audit trail preservation (recommended over delete)
- Duplicate user detection on onboard (checks username AND email before creating)
Audit Log (/audit)¶
- All governance actions recorded with timestamp, actor, event type, details
- Expandable rows showing full JSON details
- Filter by event type, actor, target
- Correlation ID groups related events
- Export as CSV/JSON
Governance Alerts (/dashboard — Alerts tab)¶
- Actionable alerts with drill-down
- Detects: users with no permissions, excessive permissions, inactive users, unhealthy connectors
- Clickable alerts navigate to relevant entity
Dashboard (/)¶
- Auto-refresh every 30 seconds
- Governance Score ring (calculated from user coverage, active ratio, connector health)
- Donut charts: permissions by type
- Stats cards: users, groups, connectors, permissions, pending requests
- Connector health badges (green/yellow/red)
- Recent activity feed (last 8 audit events)
- Data pulled from:
/users,/groups,/connectors,/access-matrix,/audit-events,/requests
Reports (/reports)¶
- Governance insights and compliance overview
- Summary statistics and trends
Kai AI Assistant (/assistant)¶
- AI-powered governance assistant
- Answers questions about access, policies, and platform usage
- Public endpoint (no auth required)
Bulk Import¶
- CSV file upload for mass user creation
- Maps columns to user fields
- Validates and prevents duplicates before import
Settings (/settings)¶
- Configure tenant settings
- Connector configuration management
Connectors¶
xWiki Connector¶
| Capability | Status |
|---|---|
| Test connection | Done |
| Import users | Done |
| Import groups + memberships | Done |
| Create user (provision) | Done |
| Add user to group (push) | Done |
| Remove user from group | Done |
| Read space permissions | Done |
| Write/apply permissions | Done |
| Sync spaces for request form | Done |
| Bidirectional sync | Done |
OpenProject Connector¶
| Capability | Status |
|---|---|
| Test connection | Done |
| Import users | Done |
| Import groups + memberships | Done |
| Create user (provision) | Done |
| Add user to group (push) | Done |
| Remove user from group | Done |
| Read project memberships/roles | Done |
| Add membership + role | Done |
| Update membership (add role) | Done |
| PATCH method support | Done |
| Sync projects for request form | Done |
| Bidirectional sync | Done |
Nextcloud Connector¶
| Capability | Status |
|---|---|
| Test connection | Done |
| Import users | Done |
| Import groups + memberships | Done |
| Create user (provision) | Done |
| Add user to group (push) | Done |
| Remove user from group | Done |
| Disable user (offboard) | Done |
| Read file shares | Done |
| Bidirectional sync | Done |
Governance Features¶
Duplicate User Detection¶
Prevents creating duplicate identities at multiple levels:
- Onboard endpoint: Checks both username AND email before creating. Returns error if either exists.
- Service layer: Validates email and username uniqueness. Rejects duplicates with clear error messages.
- Connector sync imports: When importing from connected apps, checks if user already exists by username. Handles email conflicts gracefully.
- Provisioning: Before creating a user in an app, checks if they already exist. If found, links instead of creating a duplicate.
Just-in-Time Provisioning¶
When adding a user to an OpenProject group and the user doesn't exist in OP yet, the system automatically creates them before adding to the group. This ensures OpenCrowd is the single source of truth — admins never need to manually create users in target apps.
Smart Group Push¶
When a user is added to a group in OpenCrowd, the system checks which connected apps have that group registered. It only pushes to apps where the group exists, preventing cross-app pollution.
Auto-Sync Scheduler¶
Runs every 30 minutes. Syncs both xWiki and OpenProject: - Imports new users created directly in apps - Updates changed user details - Syncs group memberships - Publishes audit events for changes
Architecture¶
- Backend: Spring Boot (Kotlin), JDK 21, PostgreSQL, Redis
- Frontend: React + Vite + TypeScript, Tailwind CSS, shadcn/ui
- Auth: Keycloak (OIDC with PKCE)
- Multi-tenancy: Schema-per-tenant (PostgreSQL
search_path) - API: REST with Swagger/OpenAPI docs at
/swagger-ui.html - Deployment: Docker Compose (backend, postgres, redis, keycloak)
API Endpoints Summary¶
| Endpoint | Auth | Description |
|---|---|---|
GET /api/v1/health |
Public | Health check |
GET /api/v1/users |
Auth | List users (paginated) |
POST /api/v1/users |
Auth | Create user |
GET /api/v1/users/{id} |
Auth | Get user detail |
PATCH /api/v1/users/{id} |
Auth | Update user fields |
PUT /api/v1/users/{id}/status |
Auth | Change lifecycle status |
GET /api/v1/groups |
Auth | List groups |
POST /api/v1/groups |
Auth | Create group |
POST /api/v1/groups/{id}/members |
Auth | Add members |
DELETE /api/v1/groups/{id}/members/{userId} |
Auth | Remove member |
GET /api/v1/connectors |
Auth | List connectors |
POST /api/v1/connectors/{id}/sync-all |
Auth | Full sync |
POST /api/v1/connectors/{id}/resync |
Auth | Resync with stored creds |
GET /api/v1/connectors/resources/xwiki/spaces |
Public | List xWiki spaces |
GET /api/v1/connectors/resources/openproject/projects |
Public | List OP projects |
GET /api/v1/access-matrix |
Auth | Get all permissions |
POST /api/v1/access-matrix/toggle |
Auth | Toggle permission |
GET /api/v1/requests |
Public | List/submit requests |
POST /api/v1/requests/{id}/approve |
Auth | Approve request |
POST /api/v1/requests/{id}/reject |
Auth | Reject request |
POST /api/v1/lifecycle/onboard |
Auth | Joiner flow |
POST /api/v1/lifecycle/offboard |
Auth | Leaver flow |
GET /api/v1/audit-events |
Auth | List audit events |
POST /api/v1/assistant/chat |
Public | Kai AI assistant |
GET /api/v1/certifications |
Auth (Enterprise) | List certification campaigns |
POST /api/v1/certifications |
Auth (Enterprise) | Create campaign |
POST /api/v1/certifications/{id}/start |
Auth (Enterprise) | Start campaign |
GET /api/v1/certifications/{id}/items |
Auth (Enterprise) | List campaign items |
POST /api/v1/certifications/{id}/items/{itemId}/decide |
Auth (Enterprise) | Approve/revoke |
POST /api/v1/certifications/{id}/bulk-decide |
Auth (Enterprise) | Bulk decision |
GET /api/v1/compliance |
Auth (Enterprise) | Compliance overview |
GET /api/v1/compliance/iso27001 |
Auth (Enterprise) | ISO 27001 assessment |
GET /api/v1/compliance/sox |
Auth (Enterprise) | SOX assessment |
GET /api/v1/compliance/nis2 |
Auth (Enterprise) | NIS2 assessment |
GET /api/v1/conflicts |
Auth (Enterprise) | List sync conflicts |
GET /api/v1/conflicts/summary |
Auth (Enterprise) | Conflict summary |
POST /api/v1/conflicts/{id}/resolve |
Auth (Enterprise) | Resolve conflict |
POST /api/v1/conflicts/bulk-resolve |
Auth (Enterprise) | Bulk resolve |
GET /scim/v2/Users |
Bearer Token (Enterprise) | SCIM list/filter users |
POST /scim/v2/Users |
Bearer Token (Enterprise) | SCIM create user |
PUT /scim/v2/Users/{id} |
Bearer Token (Enterprise) | SCIM replace user |
PATCH /scim/v2/Users/{id} |
Bearer Token (Enterprise) | SCIM patch user |
DELETE /scim/v2/Users/{id} |
Bearer Token (Enterprise) | SCIM delete user |
Editions¶
See Editions and Pricing for the Community, Professional, and Enterprise feature breakdown.
Enterprise Features¶
Access Certification Campaigns (/certifications)¶
Periodic access reviews where designated reviewers confirm or revoke all permissions.
- Create campaigns with configurable scope:
- All Users — review every permission in the system
- Specific Applications — review only xWiki, or only OpenProject, etc.
- High Privilege — review admin/delete/manage permissions only
- Inactive Users — review access for dormant accounts
- Start campaign — auto-generates review items from the current Access Matrix
- Per-item decisions — Approve (confirm access) or Revoke (remove access)
- Bulk approve/revoke — process all pending items at once
- Auto-revocation — when an item is revoked, it's immediately removed from the Access Matrix
- Auto-complete — campaign completes when all items are reviewed
- Progress tracking — real-time progress bar, approved/revoked/pending counts
- Deadline support — set a deadline for campaign completion
Compliance Dashboards (/compliance)¶
Automated compliance assessments against major governance frameworks.
ISO 27001 (A.9 Access Control): - A.9.2.1 — User registration and de-registration - A.9.2.2 — User access provisioning - A.9.2.5 — Review of user access rights - A.9.2.6 — Removal of access rights on termination - A.9.4.1 — Information access restriction
SOX (IT General Controls): - ITGC-1 — Logical access controls - ITGC-2 — Segregation of duties - ITGC-3 — Periodic access reviews - ITGC-4 — Access provisioning approval - ITGC-5 — Audit trail
NIS2 (Network and Information Systems Directive 2): - Art. 21(2)(i) — Human resources security - Art. 21(2)(j) — Multi-factor authentication - Art. 23 — Incident notification - Art. 21(2)(a) — Risk analysis and security policies
Each check returns: Pass / Warning / Fail with severity (Critical, High, Medium) and detailed explanation.
SCIM 2.0 Provisioning (/scim/v2/)¶
Standard SCIM protocol endpoints (RFC 7643/7644) for integration with enterprise identity providers.
- Azure AD / Entra ID — configure "Enterprise Application" → Provisioning → SCIM endpoint
- Okta — add SCIM provisioning integration
- OneLogin, JumpCloud, etc. — any IdP supporting SCIM 2.0
Supported operations:
- GET /scim/v2/Users — List/filter users
- POST /scim/v2/Users — Create user on joiner event
- PUT /scim/v2/Users/{id} — Replace user on update
- PATCH /scim/v2/Users/{id} — Partial update (active=false for disable)
- DELETE /scim/v2/Users/{id} — Offboard user on leaver event
- GET /scim/v2/ServiceProviderConfig — Capability discovery
Filter support: userName eq "john", emails.value eq "john@company.com"
Conflict Resolution (/conflicts)¶
Detects and resolves data conflicts between OpenCrowd and connected applications.
Conflict types: - Data Mismatch — same user, different field values (email differs between apps) - Missing Local — user exists in remote app but not in OpenCrowd - Missing Remote — user exists in OpenCrowd but not in the connected app - Duplicate — multiple matches found during sync - Permission Drift — permission changed externally without going through OpenCrowd
Resolution options: - Keep Local — OpenCrowd's data is authoritative (no action) - Keep Remote — apply the remote app's value to OpenCrowd - Merge — admin manually resolves (e.g., keeps local name but remote email) - Ignore — acknowledge but take no action
Bulk resolution available for batch operations.