> For the complete documentation index, see [llms.txt](https://docs-beta.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs-beta.openiam.com/getting-started-guide/readme.md).

# Getting started with OpenIAM

This guide takes an IAM engineer who has never used OpenIAM from two empty virtual machines to a working, verified identity-lifecycle proof of concept — and then, optionally, to MFA, self-service password reset, SAML federation, and your own branding.

OpenIAM is a **self-hosted, on-premises platform**: everything — the IAM services, message bus, secrets vault, graph and search engines, database, and monitoring — runs on infrastructure you control. That is the deployment model this guide documents, and it's why the lab asks for a real VM rather than a browser tab: at the end you have evaluated the same stack you would run in production, not a hosted demo of it.

**Applies to:** OpenIAM 2026.7.1 · Rocky Linux 9 / AlmaLinux 9 · online (internet-connected) installation · MariaDB (PostgreSQL variant included)

## What you will build

A single Linux VM running the full OpenIAM stack, plus one Windows Server VM running the Active Directory PowerShell connector. The connector talks to OpenIAM over RabbitMQ and to your test Active Directory domain using a scoped service account.

{% code overflow="wrap" %}

```
┌──────────────────────────────┐      AMQP 5672       ┌─────────────────────────┐
│  Rocky/Alma 9                │◄─────────────────────│  Windows Server         │
│  OpenIAM 2026.7.1 (all       │                      │  AD PowerShell          │
│  services + MariaDB)         │                      │  connector v5           │
│  https://<openiam-host>      │                      └───────────┬─────────────┘
└──────────────────────────────┘                                  │ AD PowerShell
                                                       ┌──────────▼─────────────┐
                                                       │  Active Directory       │
                                                       │  (dedicated test OU)    │
                                                       └────────────────────────┘
```

{% endcode %}

By the end of the lifecycle POC you will have proof that OpenIAM can:

1. install cleanly from RPM and pass its own health checks;
2. serve the Webconsole and SelfService portals over HTTPS;
3. connect to Active Directory through the AD PowerShell connector;
4. import AD groups — read-only, scoped to your test OU;
5. import AD users **with their group memberships** — read-only;
6. provision a new account into AD when you create an identity in OpenIAM;
7. deprovision by **disabling** (not deleting) the AD account when the identity is removed.

The optional parts add: MFA on a single URL, a password policy with self-service reset, SAML federation with OpenIAM as IdP or as SP, and your own branding on the portals.

## Ground rules that keep this safe

* All AD work happens in a **dedicated, disposable OU** with a service account whose rights are limited to that OU.
* Imports run with **Provision to target systems disabled** until you deliberately turn provisioning on.
* The managed system is configured with **`ON_DELETE = DISABLE`** before the first write, so a delete in OpenIAM disables the AD account instead of deleting it.

## Time and path

| Part                            | Pages | Time                                      |
| ------------------------------- | ----- | ----------------------------------------- |
| Install and secure the platform | 1–4   | 2.5–4 h (mostly waiting on the installer) |
| Identity lifecycle POC          | 5–11  | 3–5 h                                     |
| Authentication and self-service | 12–13 | 1.5–2 h                                   |
| Federation (per journey)        | 14–17 | 1–2 h                                     |
| Branding                        | 18    | 1–1.5 h                                   |

Do the pages in order — each one starts from the verified end-state of the previous one and ends with a checkpoint that tells you it worked.

Ready? Start with [Prepare your lab](/getting-started-guide/prepare-your-lab.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs-beta.openiam.com/getting-started-guide/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.