ReadyRoom
AvailableAttendance and presence tracking for an LDAP-backed organization. Windows workstations report logon, logoff, screen lock and screen unlock; ReadyRoom turns those events into per-user daily attendance, group rollups, an org chart and absence notifications — without anyone filling in a timesheet.
How it works
- The workstation reports. A PowerShell client, driven by Windows Task Scheduler, fires on logon, screen lock, screen unlock and logoff.
- The server records. Each event is posted to ReadyRoom over mutual TLS and stored against the user's directory identity.
- The directory supplies the people. Users, groups and reporting structure are read from LDAP, so there is no second roster to maintain.
- Managers see the day. Attendance, group rollups, reports and the org chart are available in the web UI, and absences go out by email.
What it does
Presence without self-reporting
Attendance is derived from events the workstation already generates. Nobody clocks in, and the record reflects what actually happened at the machine.
Lock and unlock, not just logon
Screen lock and unlock are tracked alongside logon and logoff, so time away from the desk is visible rather than counted as a full day present.
Idle sessions close themselves
A scheduled job automatically checks out sessions left open past a configurable idle threshold, so a forgotten logoff does not become a 14-hour day.
Group rollups and reports
Roll individual attendance up to a group, filter by date range, and save the reports managers run repeatedly.
Org chart from the directory
Hierarchy is derived from a flat LDAP attribute. The default heuristic splits on letter and digit boundaries; where that does not fit, a regex rule whose capture groups define the levels can be added from the settings screen.
Absence notifications
A scheduled job emails absence notifications on an interval you set, so the first sign of an unexplained absence is not someone noticing an empty desk.
Role and per-group permissions
Users, managers and administrators, plus per-group grants for the cases where a role is too coarse — a manager sees exactly the groups they are entitled to.
Classification banners
Configurable banner text and colour across the top and bottom of every page, for deployments that require a visible handling marking.
Authentication
ReadyRoom prefers an X.509 client certificate and resolves the certificate's full subject DN against the directory. Browsers presenting no certificate fall back to a form login validated by the LDAP authentication provider.
One deliberate exception. Check-out runs at logoff, after the user profile — and with it their certificate store — is already gone, so it cannot authenticate. Logon caches the server-issued session identifier and logoff echoes it back, which lets the server recover the identity without a certificate.
Technical summary
| Component | Detail |
|---|---|
| Server | Spring Boot 4 on Java 21, Thymeleaf UI |
| Data | PostgreSQL for records, roles, permissions and history |
| Directory | LDAP / LDAPS — the source of truth for people and org structure |
| Client | PowerShell script registered as four Windows scheduled tasks |
| Authentication | Mutual TLS with X.509 client certificates, LDAP form login fallback |
| Roles | User, manager, administrator, plus per-group permission grants |
| Deployment | Containerized, self-hosted, configured by environment or external config |