How thunder-id/thunderid works
ThunderID is an IAM runtime for human, agent, and machine identities. A typical journey begins with an application or user request, enters the server’s authentication and flow-execution layers, and runs configured steps such as passkey, OTP, federation, or consent before producing an authenticated session or OAuth/OIDC token. Separate capabilities cover authorization, identity administration, and decentralized credentials. The README documents these product branches; the supplied source excerpts mainly show frontend route resolution and flow-editor drag/drop, so detailed backend call wiring is not established here.
Main entry points: authn/service.go Authentication · engine.go Journey execution · main.go IAM server · authz/service.go Authorization
Components 24
Identity journeys
- Journey execution
backend/internal/flow/flowexec/engine.go - Journey graph
backend/internal/flow/core/executor.go - Journey definitions
backend/internal/flow/mgt/service.go - Authentication
backend/internal/authn/service.go - Passkeys
backend/internal/authn/passkey/service.go - Federated login
backend/internal/authn/oauth/service.go - User consent
backend/internal/authn/consent/service.go - Journey session
backend/internal/flow/session/service.go
Identity protocols
- OAuth and OIDC
backend/internal/oauth/oauth2/token/service.go - Credential issuance
backend/internal/openid4vci/handler.go - Credential verification
backend/internal/authn/openid4vp/service.go
Access governance
- Authorization
backend/internal/authz/service.go - Policy engines
backend/internal/authz/engine/engine.go - Consent management
backend/internal/consent/service.go
Identity administration
- Identity entities
backend/internal/entity/service.go - Agent identities
backend/internal/agent/service.go - Groups and OUs
backend/internal/group/service.go
Runtime and design
- IAM server
backend/cmd/server/main.go - Identity connections
backend/internal/connection/service.go - Journey presentation
backend/internal/design/resolve/service.go - Journey editor
frontend/packages/configure-flows/src/hooks/useDragDropHandlers.ts
Other components
- User or agent
- Application or API
- Credential wallet
Connections 22
- User or agent → IAM server: starts journey
- Application or API → IAM server: requests access
- IAM server → Journey execution: dispatches journey
- Journey execution → Journey graph: executes graph
- Journey execution → Journey session: stores session state
- Journey definitions → Journey graph: defines journeys
- Authentication → Passkeys: supports passkeys
- Authentication → Federated login: supports federation
- Authentication → User consent: handles consent
- Application or API → OAuth and OIDC: uses OAuth/OIDC
- OAuth and OIDC → Application or API: issues tokens
- Credential wallet → Credential issuance: requests issuance
- Credential issuance → Credential wallet: issues credentials
- Credential wallet → Credential verification: presents credentials
- Authorization → Policy engines: evaluates access
- Authorization → Consent management: uses consent
- User or agent → Identity entities: administers identity
- User or agent → Agent identities: administers agents
- Identity entities → Groups and OUs: supports membership
- Identity connections → Federated login: configures providers
- Journey editor → Journey definitions: edits journeys
- Journey presentation → User or agent: provides themed UI