Adit — Redmine Identity & Access Management Plugin
Enterprise identity and access management for Redmine
Add SAML, OIDC, enforced 2FA, access policies, automated SCIM 2.0 user provisioning and audit logging to Redmine 5 and 6. Configure everything from the Redmine administration interface without editing configuration files or restarting the server.
Overview
Adit is a commercial plugin that brings enterprise identity and access controls to a Redmine you already run. Single sign-on, mandatory two-factor authentication, automated user provisioning from your identity provider, centrally managed access policies and a complete audit trail — all managed from the Redmine administration interface, with no configuration-file edits and no server restarts.
Key features
SAML SSO
Connect Redmine to your existing enterprise identity provider using SAML 2.0.
OpenID Connect
Authenticate Redmine users through standards-based OpenID Connect providers.
Enforced 2FA
Require two-factor authentication globally or for specific groups or roles, layered on Redmine's built-in 2FA. Optionally accept IdP-asserted MFA as satisfying the requirement for that session.
Optional auto-registration
Optionally auto-register external users in Redmine the first time they sign in through SSO, gated by a login check page and your access policies.
Access policies
Enforce SSO-only login, IP allow and deny lists, and idle and absolute session timeouts — all managed centrally from the Redmine administration interface.
Automated SCIM 2.0 provisioning
Let identity providers such as Microsoft Entra ID and Okta create, update and deactivate Redmine users and keep group memberships in sync over a standards-compliant SCIM 2.0 API.
Audit logging
Record every identity, authentication and administration event in an append-only log with a filterable viewer, CSV export and configurable retention.
Emergency access
Issue a one-time, time-limited recovery token to sign in locally if SSO is ever misconfigured or password login is disabled — so administrators are never locked out.
Administration interface
Configure identity providers and security policies directly from Redmine without editing deployment configuration.
See Adit in action
SCIM
Provision Redmine users and groups from your identity provider
Adit includes a native SCIM 2.0 server — the standard endpoint identity providers like Microsoft Entra ID and Okta push to. Your provider automatically creates, updates and deactivates Redmine users and keeps group memberships in sync, so joiners, movers and leavers are handled centrally. Deactivation locks the Redmine account rather than deleting it, and every SCIM operation is written to the audit log. Adit is the SCIM server, not a client — your provider connects to it; Adit never reaches out to pull a directory.
Compatibility
Works with your identity infrastructure
Compatible with standards-compliant SAML 2.0 and OpenID Connect identity providers.
Supported Redmine
- Redmine 5
- Redmine 6
Security & audit
Built for security reviews
Help your Redmine deployment address common identity, access-control and audit requirements during security reviews. Every identity, authentication and administration event is recorded in an append-only log you can filter, export to CSV and retain for a configurable period, so you can demonstrate who did what, and when. Provider secrets — SAML private keys and OIDC client secrets — are encrypted at rest.
Pricing
Simple, per-instance licensing
Adit is licensed annually, per production Redmine instance. Every licence includes a staging or test installation, and every plan includes every Adit feature — SAML, OIDC, 2FA, SCIM, access policies and audit logging are never locked behind a higher tier.
Early adopter pricing for the first 10 organizations.
Team
Up to 50 active users
€390 / year · first year renews at €490 / year
- 1 production instance
- 1 staging or test instance
- All Adit features
- Updates
- Standard email support
Business
Up to 250 active users
€690 / year · first year renews at €890 / year
- 1 production instance
- 1 staging or test instance
- All Adit features
- Updates
- Standard email support
Enterprise
Up to 1,000 active users
€1,190 / year · first year renews at €1,490 / year
- 1 production instance
- 2 staging or test instances
- All Adit features
- Updates
- Priority support
- 1-hour remote installation or onboarding call
- Enterprise procurement and contract support
Enterprise Plus
More than 1,000 users
Quote-based
- Multiple production instances
- Custom support or integration needs
- Tailored terms
The early adopter price applies to the first year only. Plans renew at the standard annual price shown above.
Add-on services
Optional professional services, priced separately from the licence. Standard product fixes and installation documentation are included with your licence; configuring your specific identity infrastructure is a separate engagement.
- Remote installation €250
- Identity provider configuration €350
- Installation and identity provider setup package €490
- Custom integration and migration work from €750
- Additional production instance 60% of the main licence price
Request a demo or licence
Tell us about your Redmine deployment and we'll get back to you.
Frequently asked questions
Which Redmine versions are supported?
Adit supports Redmine 5 and Redmine 6.
Does Adit require changes to configuration files?
No. Adit is configured entirely from the Redmine administration interface. You do not need to edit deployment configuration files.
Do configuration changes require a server restart?
No. Settings take effect from the administration interface without restarting the server.
Is Adit a SCIM client or a SCIM server?
Adit operates as a SCIM 2.0 server. Your identity provider (the SCIM client) connects to it and provisions users and groups into Redmine. Adit does not reach out to pull a directory from the provider — the provider pushes changes to Adit.
Can Adit provision users from Entra ID or Okta into Redmine over SCIM?
Yes. Adit's SCIM 2.0 server lets identity providers such as Microsoft Entra ID and Okta automatically create, update and deactivate Redmine users and keep group memberships in sync. Deactivating a user locks the Redmine account rather than deleting it, and every SCIM operation is recorded in the audit log.
Which identity providers are supported?
Adit works with standards-compliant SAML 2.0 and OpenID Connect identity providers.
Is Adit suitable for self-hosted Redmine?
Yes. Adit is designed for self-hosted Redmine 5 and 6 installations.
How does Adit store SAML and OIDC secrets?
SAML SP private keys and OIDC client secrets are encrypted at rest using ActiveRecord Encryption (AES-256-GCM). If your Redmine already runs its own ActiveRecord Encryption keyring, Adit uses it. Otherwise, set three environment variables before saving provider secrets — ADIT_AR_ENCRYPTION_PRIMARY_KEY, ADIT_AR_ENCRYPTION_DETERMINISTIC_KEY and ADIT_AR_ENCRYPTION_KEY_DERIVATION_SALT. Adit fails closed: if the keys are absent it will not store secrets in plaintext, and Redmine keeps running while the admin screen flags the missing configuration.
Can I restrict Redmine to SSO only, or limit logins by IP?
Yes. Access policies can enforce SSO-only login (optionally hiding the password form), disable native password login, and apply IP allow and deny lists to interactive logins, with a separate allow list for the SCIM endpoint. Idle and absolute session timeouts are configurable as well.
What happens if SSO is misconfigured and no one can log in?
Adit includes an emergency escape hatch: an administrator can issue a one-time, time-limited recovery token (valid for one hour by default) that allows a local sign-in even when SSO-only mode or disabled password login would otherwise block access. The token is stored only as a hash and expires automatically.
What is included in the annual licence?
Every licence includes all Adit features, product updates, the support tier for your plan, one production instance and at least one staging or test installation.
Is staging usage included?
Yes. Each licence includes a staging or test installation alongside your production instance.
How is the active user limit calculated?
The plan tiers are based on the number of active user accounts in your Redmine instance.
Is installation support included?
Installation documentation is included with every licence. Hands-on remote installation is available as a paid add-on, and Business and Enterprise plans include a remote installation or onboarding call.
Can I license multiple Redmine instances?
Yes. Additional production instances are available at 60% of the main licence price, and Enterprise Plus covers multiple production installations.
Bring enterprise identity and access management to your Redmine
Request a demo, ask about licensing, or talk through your identity setup.
Request a demo