ESIA with GOST signing
Our own Gosuslugi module: requests are signed with GOST R 34.10-2012 via a signing bridge, without third-party services.
Atlas ID is a Russian single sign-on and access management platform. Employees and customers sign in to all your services with one account: password, passkey, Gosuslugi (ESIA), Yandex ID, VK ID or a qualified electronic signature. It combines the capabilities of Keycloak and Authentik and adds what is required in Russia.
An employee is created once and gets access to every service according to their role. When they leave, access is revoked immediately everywhere. Customers sign in with Gosuslugi or Yandex ID without separate registration, and consent to personal data processing is collected and stored under Federal Law 152-FZ.
ESIA with GOST-signed requests — no intermediaries or third-party gateways
certificates of the Federal Tax Service and accredited CAs via CryptoPro
own users, branding, sign-in keys and administrator console
Sign in once and work in all connected applications: web, mobile, internal. Two-step sign-in (email first, then method), remember me, single logout, session lifetimes to your policy.
Sign-in via ESIA (Gosuslugi) with GOST R 34.10-2012 request signing, sign-in with a qualified electronic signature with chain and revocation checks, Yandex ID and VK ID. Someone else's certificate cannot open someone else's account.
Passkeys (FIDO2/WebAuthn) — sign in with a fingerprint or face. One-time codes (TOTP), recovery codes, password policies, brute-force protection, mandatory second factor for administrators.
Groups of companies, legal entities and employees; a person in several organizations chooses where to sign in. Every customer gets its own realm: users, branding, Yandex and VK keys, privacy policy and its own administrator console.
Standard OpenID Connect, OAuth 2.0 and SAML 2.0 — any modern application connects without changes. Active Directory and LDAP synchronization, Kerberos sign-in in the domain, user migration with password hashes from other systems (bcrypt, scrypt).
Sign-in and administrator event log with export to your monitoring. Consent to personal data processing at registration and at first external sign-in — with a timestamp. Users can delete their own account. The administrator console is reachable from trusted addresses only.
Atlas ID takes the best of Keycloak, the most widely used single sign-on platform, and adopts the strengths of Authentik. What works out of the box, what is enabled by configuration and what is implemented for your task is marked honestly.
| Capability | Keycloak | Authentik | Atlas ID |
|---|---|---|---|
| Sign-in | |||
| Single sign-on and single logoutSign in once to all connected apps, sign out of all at once. | ✓ | ✓ | Available |
| Two-step sign-inEmail first, then the method: password, passkey, e-signature. | ✓ | ✓ | Available |
| Passkeys (FIDO2/WebAuthn)Fingerprint, face or hardware key. | ✓ | ✓ | Available |
| One-time codes (TOTP) and recovery codesSecond factor from an authenticator app. | ✓ | ✓ | Available |
| Email code sign-inPasswordless: a 6-digit code to the verified email, 10 minutes, 5 attempts. | — | ✓ | Available |
| Kerberos sign-in in the domainDomain users sign in without a password. | ✓ | ✓ | Enabled by configuration |
| External sign-in | |||
| Gosuslugi (ESIA)GOST-signed requests; full name, email, phone. | — | — | Available |
| Qualified electronic signatureCryptoPro, CA chain and revocation checks. | — | — | Available |
| Yandex ID and VK IDApplication keys per customer. | — | — | Available |
| Any OIDC/SAML providerCustomer's ADFS or another IdP. | ✓ | ✓ | Enabled by configuration |
| Protocols | |||
| OpenID Connect and OAuth 2.0Including PKCE, device flow, token exchange. | ✓ | ✓ | Available |
| SAML 2.0For enterprise and boxed systems. | ✓ | ✓ | Enabled by configuration |
| LDAP server for legacy systemsRead-only LDAPS: users and groups; the password is checked by Atlas ID. | — | ✓ | Available |
| RADIUS for Wi-Fi and VPNVPN and routers directly; WPA-Enterprise Wi-Fi via FreeRADIUS during deployment. | — | ✓ | Available |
| Directories | |||
| Active Directory and LDAP synchronizationUsers and groups from the existing directory. | ✓ | ✓ | Enabled by configuration |
| User migration with passwordsbcrypt and scrypt hash import — no password resets. | — | — | Available |
| Outbound provisioning (SCIM)Create, change or disable an employee — the same happens in customer apps. | — | ✓ | Available |
| Organizations | |||
| Organizations, legal entities, employeesA person in several organizations chooses where to sign in. | ✓ | — | Available |
| A realm and console per customerUsers, branding, keys and the customer administrator. | ✓ | ✓ | Available |
| Invitation linksEmployees join an organization by invitation. | ✓ | ✓ | Enabled by configuration |
| Customer's own domainSign-in at id.customer.ru; only the customer realm is served on it. | — | ✓ | Available |
| Access | |||
| Roles, groups and fine-grained permissionsAccess to apps and data by roles and policies. | ✓ | ✓ | Available |
| Protect apps without their own loginA gateway in front of the app: internal panels open only after Atlas ID sign-in. | — | ✓ | Available |
| "My applications" launcherAfter sign-in — tiles of available services. | — | ✓ | In development |
| Security | |||
| Brute-force protectionTemporary lockout after failed attempts. | ✓ | ✓ | Available |
| IP reputationMany failed sign-ins from one IP — the address is blocked for all accounts. | — | ✓ | Available |
| Geo sign-in checksEmail or second factor when signing in from a new country. | — | ✓ | In development |
| CAPTCHA (Yandex SmartCaptcha)Bot protection for registration and sign-in. | — | ✓ | In development |
| Console from trusted addresses onlyAdministration only from addresses you allow. | — | — | Available |
| Audit | |||
| Sign-in and administrator event logWith export to your monitoring. | ✓ | ✓ | Available |
| Event notificationsAdmin sign-in, lockouts, password changes — to Telegram and signed webhooks. | — | ✓ | Available |
| 152-FZ | |||
| Personal data consent with timestampAt registration and first external sign-in. | — | — | Available |
| Operator policy on the sign-in pageEach customer has its own. | — | — | Available |
| Self-service account deletionThe data subject's right to erasure. | ✓ | — | Available |
| Platform | |||
| Russian interface and Atlas brandSign-in pages, emails, user account. | — | — | Available |
| Cluster and high availabilitySeveral nodes, database backup, self-healing. | ✓ | ✓ | Enabled by configuration |
| Cloud or on-premisesData in Russia; air-gapped deployments possible. | ✓ | ✓ | Available |
Our own Gosuslugi module: requests are signed with GOST R 34.10-2012 via a signing bridge, without third-party services.
Challenge signing via CryptoPro, CA chain and revocation checks, protection against someone else's certificate.
Ready-made providers; each customer uses its own application keys.
bcrypt and scrypt import: users from your current system sign in with their old passwords.
Consent with timestamp, operator policy on the sign-in page, self-service account deletion.
Own users, branding, policy and administrator console — deployed by one script.
Groups of companies, legal entities and employees are synchronized from the Atlas account automatically.
Sign-in pages, emails and console in Russian; support from Russia.
Legacy systems, VPN and Wi-Fi sign in with the Atlas ID account; the password is checked by Atlas ID itself.
Security events to Telegram and customer webhooks; employees are provisioned to customer apps via SCIM.
ESIA, e-signature sign-in, passkeys, second factor and a customer realm are included with no module surcharges.
free up to 50 users, then from 150 ₽ per user per month
sign-in for your customers: 10,000 monthly active — 5,000 ₽
perpetual licence per user, cluster and staging included
One account instead of a password per service. Onboarding and offboarding in one action, a new application connected in minutes via OIDC or SAML.
Passkeys and a second factor, e-signature sign-in for sensitive operations, event log, administrator console from trusted addresses only.
A Russian platform instead of foreign single sign-on services: data in Russia, Gosuslugi and e-signature out of the box, cloud or on-premises, support in Russian.
We use cookies to make the service more convenient. Learn more — cookie policy and privacy policy.
Leave your contact — we will show the product on your task and prepare an offer.
Service: Атлас ID