FreeSCIM API | SCIM Users, Groups and Password Convergence

SCIM contract map

The API supports discovery, users, groups, filters, paging, lifecycle mutations, active-state disable, structured failures, and transaction-scoped password delivery. The control plane then follows the requested state into FreeIPA and Linux evidence.

Primary resources

Users

Create, read, replace, patch, disable, filter, paginate, and deliver a password through the guarded path.

Groups

List, read, create, filter, and preserve explicit FreeIPA lifecycle boundaries.

Errors

Structured failures, correlation context, retry guidance, and remediation.

End-to-end proof

See how a SCIM password event becomes a FreeIPA write and Linux login proof.

Password transaction boundary

The API may receive password material only when an authorized identity provider includes it in the current SCIM transaction. FreeSCIM detects it in memory, never persists or logs it, records only presence and outcome flags, and requires policy and downstream proof.

Client expectations

Use tokenized authentication and stable client identifiers.
Honor discovery, implemented filters, paging limits, ETags where required, and structured SCIM errors.
Capture status plus request/correlation context for replay diagnostics.
Do not treat an accepted HTTP response as the end of the proof chain.