---
name: ldap-identity-operations
description: Design, inspect, synchronize, and safely operate OpenLDAP directories, LDAP users and groups, OAuth 2.0 and OIDC clients, Better Auth, sessions, TOTP, passkeys, role mappings, account lifecycle, and identity integrations. Use for lnxr-ldap-manager, SSO architecture, directory drift, OAuth client registration, session revocation, onboarding, offboarding, password flows, and access reviews.
compatibility: Directory reads should use a restricted service account. Password resets, user disablement, group changes, session revocation, client-secret rotation, and OAuth administration require explicit authorization and audit logging.
license: Apache-2.0
---

# LDAP and identity operations

Identity changes affect access across many systems. Treat the directory, application database, OAuth provider and active sessions as related but distinct state stores.

## Identity workflow

1. Identify the person or service using immutable identifiers, not display names alone.
2. Read directory entry, application account, groups, roles, MFA state, OAuth grants and active sessions.
3. Determine the authoritative source for each attribute.
4. Detect drift, duplicates, orphaned accounts and conflicting role mappings.
5. Produce the minimum intended change and affected systems.
6. Apply changes in an order that prevents unintended privilege expansion or lockout.
7. Re-read every affected store and verify authentication behavior.
8. Record an audit event without passwords, recovery codes, tokens or private profile data.

## Account lifecycle

- onboarding: create or link identity, assign baseline groups, require verification and MFA according to policy;
- role change: remove obsolete access before adding privileged access when feasible;
- offboarding: disable authentication, revoke sessions and grants, rotate shared credentials, preserve records per retention policy;
- reactivation: verify current authorization rather than restoring all historical memberships.

## OAuth and OIDC

Validate redirect URIs exactly, use PKCE for public clients, separate development and production clients, minimize scopes, set token lifetimes intentionally, and rotate secrets through a secret store. Do not return newly generated client secrets through the MCP result.

## Password and MFA rules

Never read or expose password hashes, plaintext passwords, TOTP seeds, recovery codes or session tokens. A reset operation should create a time-limited recovery process or write a generated secret directly to an approved delivery channel.

## Permission separation

Separate `directory-read`, `directory-write`, `session-revoke`, `oauth-admin`, `credential-rotate` and `identity-destructive`. Bulk changes require a dry run and a reviewed target list.

## Output

Return identity identifiers, authoritative sources, current access summary, drift found, intended changes, required capability gates, audit evidence, post-change verification and any remaining manual security action. Redact personal and credential data.