SCIM payload, request identity, eligible-user gate, and execution context are captured without persisting secret material.
End-to-end proof chain
An API success is only the beginning.
The capability is considered working only when the intended identity state reaches the directory and the downstream Linux behavior agrees with it.
Canonical identity, username, email, active state, and directory-safe transformations are resolved before the write.
The bounded directory route performs the identity or password write and returns a non-secret operational result.
Current downstream login validation confirms that directory state became usable system identity.
Password convergence
Secret handling is intentionally narrow.
When an identity provider includes a password in an authorized SCIM transaction, FreeSCIM handles it only in memory, applies the eligible-user and execution gates, sends it through the bounded FreeIPA password route, and records only the non-secret result.
- No standing password-read API is assumed.
- No plaintext password is persisted, logged, echoed, or returned.
- Current-capture evidence is required for a new proof run.
- Guard, write, directory result, Linux result, request ID, and remediation remain inspectable.
Lifecycle coverage
Identity lifecycle is broader than create and disable.
FreeSCIM keeps reconciliation, mapping, drift, and proof beside the lifecycle operations themselves.
Users
Create, read, replace, patch, disable, filter, page, retry, and reconcile.
Groups
Visibility, creation, filtering, snapshots, membership evidence, and authority boundaries.
Mappings
Canonical identity, usernames, email, manager, active state, and directory-safe transformation.
Drift
Provider and FreeIPA snapshots, compare-first workflows, execution previews, and bounded repair.
Definition of success
Usable identity, not merely a successful request.
The proof chain continues until the target directory and Linux login behavior agree with the requested lifecycle outcome.