Tremolo Security - A Different Approach

The identity and access management (IAM) market is described as mature, with most large organizations already running IAM capabilities for onboarding/offboarding, authentication, and governance of identity data. However, rising IT complexity and the growth of APIs are exposing limitations in traditional “suite” IAM products, as access decisions increasingly depend on richer user attributes and contextual requirements rather than simple directory group membership. Organizations want stronger cybersecurity and operational efficiency from IAM—particularly workflow-driven approvals, real-time authorization based on identity attributes and context, and governance via robust identity management—while avoiding rigid, overbuilt, misfitting, or expensive offerings.

Tremolo Security positions OpenUnison as an agile, modular IAM suite that can deliver a single function or a full IAM solution and can also be inserted into existing IAM environments as a targeted component. OpenUnison is open source, with an optional paid support model priced by user count. Architecturally, it is not a traditional identity manager because it does not maintain its own identity repository; instead, it connects to existing directories and databases (e.g., AD) so identity queries and access control are performed on real-time data. OpenUnison supports multiple authentication interfaces (from LDAP to SAML), offers SSO for relying applications, provides a virtual directory to normalize access across heterogeneous data sources, and includes audit logging to enable reporting and visibility into provisioning and authentication activity.

Deployment is flexible, commonly via Kubernetes in cloud environments or VM packages on-prem/hybrid, and multiple instances may be used for different needs—potentially requiring session management for SSO across instances. Tremolo’s “just in time” approach emphasizes stateless, atomic components communicating via asynchronous message queues, enabling high scalability from workforce IAM to CIAM use cases. The main tradeoff is the need for client DevOps competence to deploy, integrate, and extend the solution effectively.

• Most large organizations have IAM environments supporting onboarding/offboarding, authentication, and identity governance.
• OpenUnison provides four main components: Identity Manager, Reverse Proxy, Virtual Directory, and Audit Logs.
• OpenUnison does not maintain an identity repository and relies on existing directory or database infrastructure.
• Identity queries and access control requests are executed on real-time data from connected identity sources.
• OpenUnison supports authentication interfaces including LDAP lookups and SAML assertions.
• A single OpenUnison instance can provide single sign-on to its relying applications.
• Cloud deployments typically use Kubernetes, while on-premise or hybrid deployments often use VM packages.
• If multiple OpenUnison instances provide authentication, session management is required to support SSO across instances.
• OpenUnison is offered as fully open source with no direct cost or as open source with paid support priced by number of users.
• The architecture is modularized and stateless, using message queues for communication between atomic components.

• “The key requirement these days is agility.”
• “OpenUnison is a flexible IAM product suite that can support a single IAM function or provide a complete IAM solution.”
• “It maintains no identity repository, it relies on a client’s existing directory or database infrastructure.”
• “Identity queries or access control requests are therefore actioned on real-time data.”
• “OpenUnison provides a full logging facility that can be accessed by a log aggregation service, or dashboard application.”
• “To best exploit the capabilities of OpenUnison a DevOps competence is valuable.”
• “Tremolo have coined the phrase ‘just in time’ to define their approach to IAM.”
• “The solution does not rely on data updates or batch processes.”
• “It is comprised of atomic components that perform their functions when invoked.”
• “OpenUnison invites customers to configure their IAM infrastructure to suit their unique requirements, it is highly scalable and able to accommodate multiple deployment patterns.”