mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
97 lines
2.8 KiB
Markdown
97 lines
2.8 KiB
Markdown
# SCIM Provisioning Workflows
|
|
|
|
## User Provisioning Workflow
|
|
|
|
```
|
|
1. Admin assigns user to Okta application
|
|
│
|
|
2. Okta checks if user exists (GET /Users?filter=userName eq "user@domain.com")
|
|
│
|
|
├── User NOT found → Okta sends POST /Users with user attributes
|
|
│ │
|
|
│ └── SCIM server creates user → Returns 201 Created
|
|
│
|
|
└── User found → Okta sends PUT /Users/{id} to update attributes
|
|
│
|
|
└── SCIM server updates user → Returns 200 OK
|
|
```
|
|
|
|
## User Deprovisioning Workflow
|
|
|
|
```
|
|
1. Admin unassigns user from Okta application (or user deactivated in Okta)
|
|
│
|
|
2. Okta sends PATCH /Users/{id}
|
|
Body: {"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
|
|
"Operations":[{"op":"replace","value":{"active":false}}]}
|
|
│
|
|
3. SCIM server deactivates user (sets active=false, revokes sessions)
|
|
│
|
|
4. Returns 200 OK with updated user object
|
|
```
|
|
|
|
## Group Push Workflow
|
|
|
|
```
|
|
1. Admin enables Group Push for Okta group
|
|
│
|
|
2. Okta sends POST /Groups with group name and initial members
|
|
│
|
|
3. When group membership changes in Okta:
|
|
│
|
|
├── Member added → PATCH /Groups/{id}
|
|
│ Op: add, path: members, value: [{value: userId}]
|
|
│
|
|
└── Member removed → PATCH /Groups/{id}
|
|
Op: remove, path: members[value eq "userId"]
|
|
```
|
|
|
|
## Profile Sync Workflow
|
|
|
|
```
|
|
1. User profile updated in Okta (e.g., department change)
|
|
│
|
|
2. Okta sends PUT /Users/{id} or PATCH /Users/{id}
|
|
Body includes updated attributes
|
|
│
|
|
3. SCIM server updates user attributes in local database
|
|
│
|
|
4. Returns 200 OK with full updated user representation
|
|
```
|
|
|
|
## Error Recovery Workflow
|
|
|
|
```
|
|
1. SCIM operation fails (network timeout, server error)
|
|
│
|
|
2. Okta logs failed task in Provisioning > Tasks
|
|
│
|
|
3. Admin can retry individual failed tasks
|
|
│
|
|
4. For persistent failures:
|
|
├── Check SCIM server logs for error details
|
|
├── Verify network connectivity and TLS certificate
|
|
├── Validate bearer token has not expired
|
|
└── Review attribute mapping for data format issues
|
|
```
|
|
|
|
## Implementation Testing Workflow
|
|
|
|
```
|
|
1. Deploy SCIM server to staging environment
|
|
│
|
|
2. Configure Okta SCIM integration with staging URL
|
|
│
|
|
3. Run Okta SCIM validator test suite
|
|
│
|
|
4. Test manual operations:
|
|
├── Assign test user → verify account created
|
|
├── Update user profile → verify attributes synced
|
|
├── Unassign user → verify account deactivated
|
|
└── Push group → verify group and members created
|
|
│
|
|
5. Review provisioning logs in Okta Admin Console
|
|
│
|
|
6. Promote to production with production SCIM URL
|
|
```
|