From d8c6045d8747b76923161b033756481ebc519fc5 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 10 Oct 2026 14:34:20 +0000 Subject: [PATCH] IAM plan V16: phases 1-3 landed; open items Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- docs/DIRECTORY-SIMULATION-POC.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/DIRECTORY-SIMULATION-POC.md b/docs/DIRECTORY-SIMULATION-POC.md index 13720e3..b947e9c 100644 --- a/docs/DIRECTORY-SIMULATION-POC.md +++ b/docs/DIRECTORY-SIMULATION-POC.md @@ -435,7 +435,19 @@ no-population-intermediate rule. the emulated domain. Results pass the RBAC plug before they are encoded; refused objects are absent, not redacted. + **Status (2026-10-10):** phase 1 is `observe::from_graph` (lance-graph + #1450), phase 2 is `ad::project` + `ad::to_ldif` (#1452), phase 3 is + `ldap::Server` (#1453). Each entry carries `dirSimOrigin` (`observed`, + `mirrored`, `synthetic`, `simulated`); a node's RDN is `CN=` + because no display name is read. The LDAP handler takes bytes and + returns bytes, so dir-sim stays free of I/O; access is the host's + `Authority` (bind, entry visibility, attribute readability), and a + hidden entry answers `noSuchObject` as a search base. **Open:** groups and memberships from Graph (phase 1 reads users only); + display names (the RDN is the GUID until one is read); the host binary + that runs the LDAP listener and plugs `Authority` into the RBAC plug; + objects under a non-OU container such as `CN=Users`, which the OU path + places at the domain root; a synthetic DN for the cloud-only user that a real LDAP client can bind as; whether the emulated domain name is the on-premises one or the tenant's initial domain when there is no hybrid.