Group visibility and authority boundaries

Grouping mechanics

Group and membership data is where identity inheritance mistakes are most common. FreeSCIM exposes group visibility and creation while keeping replacement, deletion, and high-risk lifecycle behavior behind the FreeIPA/IdM authority boundary.

Practical controls

• Normalize group names and FreeIPA cn identifiers before reconciliation.
• Use snapshots to explain membership drift before proposing repair.
• Keep reconciliation jobs bounded by explicit chunk sizes.

Scale considerations

For large enterprises, snapshot-based membership deltas make drift visible before an operator approves repair outside the public SCIM group replacement/deletion path.

Scale and reconciliation

For large directories, compute chunked membership diffs and store connector sequence numbers so review can resume from the last inspected chunk.

• Keep membership review under bounded batch size.
• Log source-of-truth change timestamp and operator identity.
• Reject ambiguous repair plans against the same member in one review window.