SCIM request identity, payload shape, correlation, and execution context are captured without retaining secret material.
Proven path
A lifecycle request is followed through enforcement, not stopped at HTTP success.
The current proof covers SCIM behavior, canonical mapping, directory-aware lifecycle handling, Linux trust, and login validation without treating the separate password-write milestone as already complete.
Login identity, contact address, SCIM username, directory uid, and Kerberos principal remain distinct and traceable.
Bounded FreeIPA operations apply the supported identity state while HBAC, Kerberos, POSIX identity, and host authorization remain native authority.
Trust, SSSD/PAM, Kerberos, HBAC, and login evidence show that the controlled Linux enforcement path is functioning.
Password truth
Observe and dry-run are proven. The real write is not.
FreeSCIM can detect password material in an eligible SCIM transaction, keep it in memory, redact it from durable evidence, evaluate the execution gates, and produce observe or dry-run evidence. The canonical proof record does not yet mark the real identity-provider password event, real FreeIPA password write, or real post-write rollback as complete.
- No standing password-read API is assumed.
- No plaintext password belongs in SQL, logs, replay bundles, or API responses.
- Real write execution stays blocked until the required proof and approval state exists.
- Rollback machinery exists, but post-write rollback must still earn end-to-end proof.
Proof ledger
Password convergence has multiple milestones, not one status light.
Separating the milestones keeps the public story aligned with the actual safety program.
| Milestone | State | Meaning |
|---|---|---|
| Password detection and redaction | Operational | Sensitive fields are detected and kept out of durable evidence. |
| Observe mode | Proven | The transaction can be inspected without applying a password change. |
| Dry-run execution | Proven | The guarded execution path can produce non-mutating evidence. |
| External password-origin event | Not proven | The real upstream password event remains an outstanding milestone. |
| Real FreeIPA password write | Blocked | The adapter exists, but the real-write proof has not been completed. |
| Rollback after real write | Not proven | Rollback support exists without the final governed write-and-restore proof. |
Identity runtime preview
Look up a sample identity and see how authority stays explainable.
The real operator surface separates canonical identity, authentication eligibility, Linux authorization, HBAC context, and reconciliation actions.
Lifecycle coverage
The platform now manages more than provisioning calls.
Identity provenance, authority decisions, reconciliation, replay, and recovery are part of the same operating model.
Users
Create, read, replace, patch, disable, filter, page, retry, and reconcile.
Groups
List, read, filter, create, membership evidence, snapshots, and native IdM boundaries for unsupported replacement or deletion.
Identity provenance
Canonical username, contact identity, provider identity, directory uid, and Kerberos principal remain traceable.
Controlled execution
Observe, dry-run, mutation audit, snapshots, blocked states, approvals, and rollback candidates.
Drift and replay
Compare-first workflows, snapshots, drift artifacts, read-only replay, correlation, and evidence-first remediation.
Operator surfaces
Landing, FreeIPA, Okta, Sync, Mapping, and Admin dashboards expose bounded operational truth.
Definition of success
Prove each authority transition separately.
FreeSCIM can show strong lifecycle and Linux proof today without pretending the password authority migration has already crossed its final write and rollback gates.