Skip to content

IAM plan V16: phases 1-3 landed; open items #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AdaWorldAPI merged 1 commit into from
Oct 10, 2026
Merged

IAM plan V16: phases 1-3 landed; open items #343

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions docs/DIRECTORY-SIMULATION-POC.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,7 +435,19 @@ no-population-intermediate rule.
the emulated domain. Results pass the RBAC plug before they are
encoded; refused objects are absent, not redacted.

**Status (2026-10-10):** phase 1 is `observe::from_graph` (lance-graph
#1450), phase 2 is `ad::project` + `ad::to_ldif` (#1452), phase 3 is
`ldap::Server` (#1453). Each entry carries `dirSimOrigin` (`observed`,
`mirrored`, `synthetic`, `simulated`); a node's RDN is `CN=<objectGUID>`
because no display name is read. The LDAP handler takes bytes and
returns bytes, so dir-sim stays free of I/O; access is the host's
`Authority` (bind, entry visibility, attribute readability), and a
hidden entry answers `noSuchObject` as a search base.
**Open:** groups and memberships from Graph (phase 1 reads users only);
display names (the RDN is the GUID until one is read); the host binary
that runs the LDAP listener and plugs `Authority` into the RBAC plug;
objects under a non-OU container such as `CN=Users`, which the OU path
places at the domain root;
a synthetic DN for the cloud-only user that a real LDAP client can bind
as; whether the emulated domain name is the on-premises one or the
tenant's initial domain when there is no hybrid.
Expand Down
Loading