Product

Identity convergence without surrendering authority boundaries.

FreeSCIM turns SCIM lifecycle intent into controlled FreeIPA state, connects human federation to operator roles, and preserves the mapping, drift, audit, and health evidence needed to run the path safely.

SCIM lifecycleFreeIPA enforcementSAML federationsync + driftgoverned transition
Source intentOktaProfiles, assignments, SAML authentication, and SCIM lifecycle.
FS
MediationFreeSCIM

Map. Guard. Reconcile. Prove.

Linux authorityFreeIPADirectory, Kerberos, POSIX identity, groups, and HBAC.
EvidenceAuditrequest + outcomeDriftexpected + observedHealthpath readinessRecoverysafe next state
Four product planes

The product follows the identity transaction from request to enforcement.

Each plane has a narrow job. Together they produce a lifecycle path that is observable enough to operate and constrained enough to trust.

01

Lifecycle mediation

Receive SCIM users, normalize identifiers and attributes, enforce request rules, apply bounded writes, and return standards-aware results.

POSTGETPUTPATCHactive state
 02

Authority mediation

Keep Okta, FreeSCIM, and FreeIPA responsibilities explicit so provisioning never quietly becomes authentication or access policy.

OktamappingFreeIPAHBAC
 03

Federation and sessions

SAML is the preferred production SSO path. OIDC remains a parallel governed capability with readiness, key, role, and session evidence.

SAMLOIDCroles
 04

Evidence and reconciliation

Mappings, persistent sync, snapshots, drift, audit, health, and logs show whether intent and downstream state still agree.

syncdriftaudit
Governed authority transition

Password convergence is a staged migration, not a checkbox.

FreeSCIM has the plumbing to receive transaction-scoped password material safely, but production authority moves only through explicit readiness, pilot, and rollback gates.

01DisabledReject password push and record the blocked attempt safely.
02ObserveDetect and redact without applying a directory change.
03TestExercise approved test identities without committing the write.
04PilotApply only for the approved pilot cohort with rollback ready.
05EnableCut over only after the operating proof supports production scale.
Supporting extensions

The identity product can see farther without claiming every system as its own.

Operational integrations add context around the identity path. They are useful, but they do not redefine the core authority model.

Fleet contextForeman and Puppet can enrich host and environment understanding around directory identities.
Remote supportSSH, VNC, jump paths, and Guacamole can carry bounded support actions with evidence.
Data operationsPostgreSQL health, schema, backups, retention, and recovery protect the platform’s own operating memory.
TopologyRelationships can be visualized while configured, inferred, cached, and live state remain distinguishable.
Federation runtimeApplication readiness, trust health, key freshness, and drift can be tracked without replacing the upstream IdP.
Future SCIM adaptersNew destinations can reuse the mediation pattern only after target-specific authority and proof are defined.
What it deliberately is not

Clear non-goals keep automation from becoming accidental authority.

The platform is designed to bridge responsibilities, not erase them.

Not a password vaultStanding cleartext passwords are not pulled from Okta or retained for later replay.
Not an HBAC bypassA successful provisioning event does not grant Linux access outside FreeIPA policy.
Not a replacement IdPOkta remains the human authentication and MFA authority in the current model.
Not proof by existenceA route or module is not called production-proven until the full environment-specific path has been validated.
A bridge that can become a platform

Scale the operating model, not the ambiguity.

The strongest path forward is to keep one common policy and evidence plane while adding provider-specific adapters only where their authority contracts are explicit.

Open runtime truthReview exact capability states