Create, read, update, patch, active-state disable, paging, filtering, mapping, replay-safe behavior, and structured errors.
The actual product
A bridge that knows the difference between provisioning, authentication, and authorization.
FreeSCIM is valuable because it does not pretend one identity system owns every decision. It carries intent between systems while keeping the authority boundaries visible.
01 / Lifecycle
Receive and normalize identity change.
SCIM requests are translated into profile and lifecycle semantics that the directory can understand.
- User create, read, replace, patch, and disable
- Filtering, paging, error contracts, and concurrency
- Bounded group list, read, and create
02 / Identity
Keep every identifier in its proper role.
Canonical identity provenance separates login, contact address, SCIM username, directory uid, and Kerberos principal instead of flattening them into one field.
- Canonical username policy
- Attribute authority matrix
- Directory-safe mapping and transforms
03 / Execution
Make risky actions pass through visible gates.
Mutation audit, pre-write snapshots, observe mode, dry-run, approval boundaries, and blocked controls turn execution state into part of the product.
- SCIM mutation audit
- FreeIPA mutation safety
- Controlled execution states
04 / Reconciliation
Compare before attempting repair.
Persistent comparison, snapshots, mapping health, drift artifacts, replay candidates, and change history make disagreement visible without silently correcting it.
- Sync comparison and history
- Drift and snapshots
- Auto-remediation remains blocked
05 / Trust
Operate federation as a governed lifecycle.
SAML, governed OIDC, application onboarding, provider maturity, trust health, key intelligence, drift, and readiness are managed as observable state.
- SAML remains the primary SSO path
- OIDC relying-party path is environment-gated
- Future providers stay declared until live proof
06 / Evidence
Retain enough context to explain and recover.
Correlation, operational replay, evidence integrity, retention controls, degraded-mode labeling, and runtime survivability make day-two operation part of the control plane.
- Read-only replay bundles
- Evidence integrity and retention
- Survivability and degraded-state reporting
Lifecycle path
Every identity change moves through a visible sequence.
That sequence is the difference between a simple SCIM endpoint and an operational identity bridge.
Authority is a feature
One operating picture without turning everything into one authority.
The architecture stays credible because every major responsibility has an explicit owner.
Inside the control plane
Use the same menus and workflow shapes operators actually see.
This interactive preview is reconstructed from the current runtime templates and front-end controls. Private branding, hosts, identities, credentials, and live mutation paths have been removed.
Runtime truth ledger
The platform says what is proven, what is governed, and what is still blocked.
These states follow the canonical runtime evidence rather than treating implementation presence as production proof.
| Capability | Current state | Meaning |
|---|---|---|
| SCIM service and conformance | Proven | User lifecycle, discovery, filtering, paging, errors, and secret-safe behavior have direct proof. |
| Canonical identity and authority mapping | Operational | Identity provenance and attribute authority are implemented across operator surfaces. |
| Observe and dry-run execution | Proven | Controlled execution can gather evidence and preview sensitive changes without committing the write. |
| Linux trust and login validation | Proven | The controlled Linux proof path has direct trust and login evidence. |
| Real identity-provider password event | Not proven | The external password-origin milestone remains outstanding in the canonical truth table. |
| Real password write and rollback | Blocked | Write and rollback machinery exist, but the real write and post-write rollback proof chain is not complete. |
| Database runtime posture | Needs attention | Database governance is implemented, but the latest runtime audit reports schema and maintenance findings. |
Built to grow without pretending it already has
Start with the identity bridge. Extend only where the evidence supports it.
The same bounded-adapter model can support additional SCIM destinations, federation relationships, and operational integrations. Current capability and future direction stay deliberately separated.