Get Started

Export

Export identities from a synthetic fixture, a flat CSV/JSON file, a running Ory Kratos instance, or a Keycloak realm export into the Canonical Migration Format (CMF).

Map

Scaffold a mapping.yaml from source fields to CMF, with custom metadata flagged for review rather than guessed at.

Validate

Dry-run a CMF file against a target’s capabilities — no network calls — to catch unsupported hash algorithms or MFA types early.

Import

Chunk, submit, and poll your target’s bulk import job, translating every portable password hash and MFA factor along the way.

Diff

Reconcile a CMF file against the live target after import.

Quick start

# Install (see the installation guide for Docker, Homebrew, and package options)
brew install cerberauth/tap/iamigrate

# Generate synthetic test data + a cleartext answer key for login verification
iamigrate testdata generate --count 1000 --hash bcrypt:cost=10 --mfa totp:rate=0.3 --out ./fixtures/

# Dry-run against your target's capabilities, no network calls
iamigrate validate --in ./fixtures/users.cmf.jsonl.gz --target auth0

# Import into a disposable Auth0 tenant
iamigrate import auth0 --in ./fixtures/users.cmf.jsonl.gz --connection-id con_xxx

# ...or into a running Ory Kratos instance
KRATOS_ADMIN_URL=http://127.0.0.1:4434 iamigrate import kratos --in ./fixtures/users.cmf.jsonl.gz --schema-id default

# ...or into a Keycloak realm
iamigrate import keycloak --in ./fixtures/users.cmf.jsonl.gz \
  --url http://127.0.0.1:8080 --realm acme --username admin --password admin

Explore the docs

Installation Install via go install or from source.

Import users into Auth0 Step-by-step guide: hashes, MFA, validation, import, and verification.

Import users into Ory Kratos Step-by-step guide: identity schema, hashes, validation, import, and verification.

Export users from Ory Kratos Export identities and password hashes, and what gets left behind.

Import users into Keycloak Step-by-step guide: realm setup, hashes, validation, import, and verification.

Export users from Keycloak Export identities and password hashes from a realm export, and what gets left behind.

Generate test fixtures Synthetic users with every hash algorithm and MFA factor type, plus an answer key.

CLI reference All commands and flags.