Trust begins with separation
Human authentication, SCIM provisioning, password delivery, OIDC token exchange, FreeIPA writes, Foreman enrichment, SSH and Guacamole access, power control, and database maintenance use different credentials, protocols, and privilege boundaries.
Secret and evidence controls
- Plaintext passwords are used only in the authorized transaction path and are never persisted or logged.
- SCIM bearer tokens, OIDC tokens, SAML assertions, cookies, client secrets, database credentials, and private keys are redacted or excluded.
- Operational APIs report whether secrets are configured, not their values.
- Remote-console URLs are tokenized and scoped; service identities and keys remain outside the public code surface.
- Correlation IDs connect events without exposing sensitive payloads.
Control boundaries
| Boundary | Authority and control |
|---|---|
| Human identity | External identity provider and MFA; FreeSCIM validates trust and governs the application session. |
| Provisioning | SCIM bearer ingress with schema, filter, mapping, lifecycle, password, and replay controls. |
| Linux identity | FreeIPA remains the directory, Kerberos/POSIX, HBAC, group, and authorization authority. |
| Host enrichment | Foreman and Puppet facts enrich inventory without silently replacing reviewed operational records. |
| Remote support | Dedicated jump and relay paths, scoped identities, short-lived launches, and workstation-specific readiness. |
| Database | Preview, approval, backup, advisory locking, destructive-SQL blocking, retention policy, and verification. |
Evidence status
The public site uses Proven, Operational, Governed, and Portable pattern rather than blending implemented code, enabled deployment, and end-to-end proof into one claim.
Fail closed, explain clearly
Missing policy, route readiness, privilege, jump reachability, migration safety, or proof evidence should block the action and tell the operator why. A visible gate is a security feature, not an unfinished product state.