SP initiation, MFA handoff, ACS validation, assertion checks, claims, role mapping, logout, readiness, and failure evidence.
Parallel protocols
One operating model without pretending the protocols are the same.
FreeSCIM keeps the trust mechanics honest while giving operators a common view of readiness, decisions, sessions, failures, and response.
Discovery, JWKS validation, authorization-code flow, state, nonce, PKCE, scopes, group claims, role mapping, and sessions.
Registered applications, clients, signing keys, authorization codes, token records, and controlled federation handoff.
Provider catalog, protocol health, topology, session state, drift, replay evidence, policy state, and diagnostics.
Security controls
The trust path is inspectable before it is trusted.
Issuer, redirect URI, discovery, keys, state, nonce, PKCE, scopes, claims, role strategy, and session behavior are explicit parts of readiness rather than hidden implementation details.
- OIDC discovery and JWKS are readiness dependencies.
- State, nonce, PKCE, scopes, and claims remain explicit controls.
- SAML and OIDC failures retain correlation without leaking assertions or tokens.
- Protocol enablement can remain governed without removing the implemented capability.
Shared evidence
Authentication events join the operational story without sharing credentials.
SCIM bearer provisioning, browser SSO, provider intelligence, and federation sessions remain separate channels. Their evidence can still be correlated safely.
Authentication starts
Initiation, callback, MFA handoff, redirect, and protocol readiness are visible as their own lifecycle.
Role decisions
Claims, groups, policy, and application role mapping stay inspectable without flattening provider semantics.
Session governance
Session establishment, logout, trust state, and suspicious patterns contribute to the same operator evidence model.
Failure intelligence
Protocol failures retain request and correlation context while protecting cookies, tokens, assertions, secrets, and private keys.
Federation is observable
Trust is a path, not a checkbox.
Successful and failed starts, callbacks, role decisions, sessions, logout, protocol health, and suspicious patterns remain available to operators as evidence.