FreeSCIM keeps provisioning, human authentication, Linux enforcement, operational context, and evidence on distinct channels. The result is a bridge that can expand without turning into a credential shortcut.
OktaSCIM · SAML · governed OIDC
PostgreSQLstate · audit · snapshots
Red Hat / Linuxdownstream enforcement proof
Puppetsupporting host factsThese are the systems the identity product directly depends on for provisioning, authentication, directory enforcement, or durable operating state.
OKTA / SOURCE
SCIM lifecycle intent reaches FreeSCIM over bearer-authenticated endpoints. SAML handles the preferred production browser SSO path, while OIDC remains a governed parallel option.
FREEIPA / ENFORCEMENT
FreeSCIM writes through controlled directory paths while FreeIPA retains ownership of Kerberos, POSIX identity, groups, HBAC, and host authorization.
POSTGRESQL / EVIDENCE
Mappings, sync sessions, changes, audit events, snapshots, drift artifacts, application settings, and backup metadata give operators durable context.
These integrations add context, operations, or evidence without changing who owns authentication or Linux access decisions.
FEDERATIONReadiness, claims, keys, sessions, role mapping, federation runtime health, and governed broker work.
FLEET CONTEXTHost, interface, environment, and fact enrichment for operational context around identities and systems.
REMOTE OPSBounded remote paths, jump context, session readiness, and operator evidence for support workflows.
DATA OPSRuntime schema visibility, backups, migrations, retention, health, and survivability around the platform database.
This public-safe console uses the current Okta and provider-governance interaction patterns, while keeping credentials and tenant-specific state out of the website.
The architecture can support additional destination adapters as long as each system gets its own mapping, authority rules, lifecycle contract, evidence, and rollback story.
ROADMAP / GITHUB ENTERPRISE
A future GitHub Enterprise adapter can reuse the same mediated-lifecycle model while keeping enterprise app assignment, organization access, team mapping, and GitHub-specific SCIM behavior explicit.
ROADMAP / ADDITIONAL IDP
Provider-specific adapters can plug into the control plane while the central policy, mapping, audit, and drift model remains consistent.
DESIGN RULE
The goal is not to make every directory identical. It is to let operators see and govern lifecycle across systems without erasing the rules unique to each one.
FreeSCIM treats each connector as its own bounded contract: authentication, scope, mapping, mutation rights, downstream validation, evidence, and recovery.