monarchy-identity¶
Company sign-in for Omarchy laptops. People sign in with the account they already have in your company directory, and you decide who may sign in.
- One account everywhere. The login screen, the lock screen, a terminal,
sshandsudoall take the company password. Nobody creates accounts on laptops by hand. - You choose who gets in. Nobody may sign in until you name a directory group (or a list of people). Add or remove people in the directory and every laptop follows.
- Optional admin rights for a directory group.
- Survives Omarchy updates, and works offline once someone has signed in.
- Scriptable. Every command runs unattended, and
status --jsontells your tooling what state a laptop is in.
It does one job: connect a laptop's sign-in to your directory. It doesn't manage the laptop (disk encryption, firewall, inventory, locking down settings); that's your MDM's job.
Providers¶
Each kind of directory is supported by a provider. Active Directory (including Samba AD) is the only provider
today; Microsoft Entra ID, Okta, Google Workspace and FreeIPA are planned. Who may sign in, sudo, offline sign-in, the
login screen and updates work the same whichever provider you use. See Status and limits.
Where to start¶
| You want to | Read |
|---|---|
| Try it on one laptop | Getting started |
| Understand what changes for people | How sign-in works |
| Plan a fleet rollout | Roll out to a fleet |
| Look up a command | CLI reference |
| Fix a problem | Troubleshooting |
Source and issues: https://github.com/blatessa/monarchy-identity. MIT licensed.