Trust begins with separation
Human authentication, SCIM provisioning, password delivery, OIDC token exchange, FreeIPA writes, Foreman enrichment, SSH and Guacamole access, power control, and database maintenance use different credentials, protocols, and privilege boundaries.
Secret and evidence controls
- Plaintext passwords are used only in the authorized transaction path and are never persisted or logged.
- SCIM bearer tokens, OIDC tokens, SAML assertions, cookies, client secrets, database credentials, and private keys are redacted or excluded.
- Operational APIs report whether secrets are configured, not their values.
- Remote-console URLs are tokenized and scoped; service identities and keys remain outside the public code surface.
- Correlation IDs connect events without exposing sensitive payloads.
Control boundaries
| Boundary | Authority and control |
|---|---|
| Human identity | External identity provider and MFA; FreeSCIM validates trust and governs the application session. |
| Provisioning | SCIM bearer ingress with schema, filter, mapping, lifecycle, password, and replay controls. |
| Linux identity | FreeIPA remains the directory, Kerberos/POSIX, HBAC, group, and authorization authority. |
| Host enrichment | Foreman and Puppet facts enrich inventory without silently replacing reviewed operational records. |
| Remote support | Dedicated jump and relay paths, scoped identities, short-lived launches, and workstation-specific readiness. |
| Database | Preview, approval, backup, advisory locking, destructive-SQL blocking, retention policy, and verification are implemented. Current schema and maintenance findings remain visible as needs-attention state rather than being hidden behind a healthy label. |
Evidence status
The public site separates Core, Operational, Governed, Needs attention, and Roadmap. A feature can be implemented while still blocked from production authority, and a provider can exist in the onboarding framework without being a live integration.
Password authority remains staged
Password material is handled only inside an eligible transaction and is excluded from durable evidence. Observe and dry-run controls have direct proof. The real upstream password event, real directory password write, and post-write rollback have not yet earned end-to-end proof, so the trust model keeps those milestones visibly blocked rather than treating implemented machinery as completed authority migration.
Fail closed, explain clearly
Missing policy, route readiness, privilege, jump reachability, migration safety, or proof evidence should block the action and tell the operator why. A visible gate is a security feature, not an unfinished product state.