Bavaria's digital school platform: high availability meets high school.

Agency for Digitisation, High-Speed Internet and Surveying (LDBV) — Foto: ©ldbv.bayern.de

Brief

Design and build a secure, GDPR-compliant, cloud-native identity management platform for all Bavarian schools, serving students, teachers, parents, and administrators across one unified ecosystem.

Technology

Java, Spring Boot, Quarkus, Keycloak, Kubernetes, Helm Charts, RabbitMQ.

Keycloak handles Single Sign-On across all connected services. Kubernetes ensures zero-downtime deployments and connected systems are provisioned in real time when data changes.

3.8 million

users on the platform

6,400+

schools connected

99.99 %

system availability

Starting Point

BayernCloud Schule (ByCS) is the central digital platform of the Free State of Bavaria for all its schools. It was developed by the Bavarian State Ministry of Education and Culture together with other ministries to digitize teaching, administration, and communication in schools in a legally secure, privacy-compliant, and efficient way. Since going into regular operation, it provides a comprehensive ecosystem of applications, services, and educational content that is continuously being extended.

To further develop BayernCloud Schule according to current technological standards — future-proof, fault-tolerant, and secure — the Free State of Bavaria decided on a complete rebuild.

Irian Deutschland was brought in as the lead technology partner. Our task: design the architecture, take care of the implementation, and develop the central Identity Management System at its core, from the ground up.

A screenshot of the BayernCloud Schule import tool showing a school year changeover import in progress with progress bars and a validation log.

Development

When 3.8 million users might log in on the same morning (right at the start of the school day), your architecture had better be ready.

We built ByCS on a fully cloud-native microservices architecture running on Kubernetes. Keycloak handles Single Sign-On across all connected services: Drive, Messenger, Exchange, mebis, and others. One login. Everything works.

RabbitMQ acts as the message broker: any change in the central user directory (— )a new student, a class transfer, a school year rollover) gets published as an event and provisioned to all downstream systems in real time. Helm Charts standardize deployments across development, test, and production.

The custom components (Admindesk, Selfservice, Import, and the Provisioning platform) were built in Java with Spring Boot and Quarkus. We chose both for their throughput and stability under load.