BERP Core

Advanced identity, user/role management, localization, menu and etc.

Features

• Organizations as tenants: one installation, each organization in its own SQL Server database, optional "2FA for everyone" rule
• Global user accounts (one email); memberships add roles, positions, manager, clearance and custom attributes per organization
• Sign-in with password, LDAP/AD, OIDC, OAuth 2.0 and SAML 2.0, with just-in-time accounts and group-to-role mapping
• Two-factor authentication (TOTP) with recovery codes
• Sessions: 15-minute JWT plus rotating refresh cookie, ending after 12 h idle or 14 days
• Invitations by email link; administrators never set passwords
• RBAC: module.resource.action permissions on per-organization roles, no self-escalation
• ABAC policies (deny wins, fail closed), also applied to lists in SQL
• HR persons link to optional user accounts; HR events create, deactivate and reactivate memberships

Requirements

• .NET 10 (SDK 10.0.4xx to build)
• SQL Server
• Node 24 (only to build the web UI)
• SMTP server for invitations
• Optional: LDAP/AD or an OIDC/OAuth/SAML identity provider
• Production: certificate for the Data Protection key ring

Setup

1. Deploy the app and open it; enter the one-time setup code from the server log.
2. Create the first organization and its database, and the platform administrator.
3. Add sign-in providers under Administration → Sign-in providers.
4. Turn on required 2FA for the organization if needed.
5. Set up roles, permissions and access policies, then invite users or let HR create them.