Proposal: Directory synchronization (inbound AD/LDAP and HR)

The workforce joiner-mover-leaver source is often on-prem Active Directory / LDAP or an HRIS. SCIM (ADR-0018) is one path; many orgs need a sync connector. This specs a pluggable inbound connector following the established provider-trait pattern (ADR-0013) — no new architectural style.

Motivation

If onboarding still means "create the user again in the IdP," adoption stalls. Sync from the system of record (AD/LDAP/HRIS) is what makes the directory authoritative without double-entry.

Design

• A pluggable inbound sync connector (a provider behind a trait, the ADR-0013 pattern): AD/LDAP and HRIS → the directory (ADR-0011), mapping external attributes and groups onto principals and group memberships, on a schedule or via change-notification.
• A lightweight agent runs in the operator's network (LDAP is not internet-exposed) and pushes to Vord's provisioning/admin API (ADR-0021); Vord never reaches into the operator's network.
• Deprovisioning joins revocation (ADR-0005), exactly as SCIM does (ADR-0018): a removed source user has live tokens killed within the freshness budget.
• Source-of-record precedence rules (which source wins on conflict); all sync steps are events (ADR-0022).

Alternatives considered

• SCIM-only — rejected: many directories don't emit SCIM; an LDAP/agent path meets them where they are.
• Direct LDAP bind at login — rejected as the primary model (couples login to on-prem availability); offered instead as a federation option (ADR-0019).

Graduation criteria

AD/LDAP users and groups sync to the directory; changes propagate; deprovisioning revokes within budget; the agent operates without exposing LDAP to the internet.

Backward compatibility

A pluggable provider + an operator-side agent; reuses provisioning / directory / revocation; no architecture change.

Open questions

• Agent deployment and security; HRIS connectors; the attribute/group mapping surface.