Architecture

Connected control planes with explicit authority and transport boundaries.

FreeSCIM connects identity intent, Linux authority, infrastructure context, remote operations, observability, and data governance without collapsing their responsibilities.

System model

FreeSCIM is a set of connected control planes, not a monolithic authority. Each plane owns a distinct decision and exchanges bounded evidence with the others.

FreeSCIM architecture with identity providers, SCIM, FreeIPA, Foreman, database, relays, classrooms, workstations, and operational evidence
Sanitized system context for the proven platform.

Architecture boundaries

Federation

SAML and OIDC authenticate humans and establish governed sessions.

Lifecycle

SCIM carries user, group, active-state, and transaction-scoped password intent.

Linux authority

FreeIPA owns directory, Kerberos/POSIX, groups, HBAC, and enforcement.

Infrastructure context

Foreman, Puppet, room inventory, relays, and probes describe the managed estate.

Remote operations

WoL, SSH, VNC, Guacamole, and dedicated jumps act on individual workstations.

Evidence and data

PostgreSQL, living ERD, logs, topology cache, snapshots, and operational memory preserve explainability.

Decision order

  1. Identify the authority and trust path.
  2. Resolve the target identity, host, room, or data object.
  3. Check readiness, health, topology, and policy.
  4. Preview the intended state transition.
  5. Apply through the bounded adapter or helper.
  6. Validate the downstream result and record evidence.

Architecture entry points

Network topology

Physical and logical relationships with health and paths.

Living ERD

Data relationships and governed schema evolution.

Evidence model

Correlated logs, security intelligence, and remediation.

Security model

Threat assumptions and control layering.