You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/about/concepts.md
+27-29Lines changed: 27 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,16 +3,21 @@ title: IdLE Concepts
3
3
sidebar_label: Concepts
4
4
---
5
5
6
-
IdLE is a generic, headless, configuration-driven engine for identity lifecycle automation (Joiner / Mover / Leaver). It intentionally separates intent from implementation: workflows (data-only PSD1 files) declare what should happen, steps implement provider-agnostic, idempotent convergence logic, and providers adapt to external systems and manage authentication.
6
+
IdLE is a **generic, headless, configuration-driven engine for identity lifecycle automation** (Joiner / Mover / Leaver). It intentionally **separates intent from implementation**:
7
7
8
-
The engine first builds a deterministic, auditable execution plan from a LifecycleRequest and a workflow (Plan → Execute). Planning validates conditions, inputs, and required provider capabilities; execution runs only the produced plan to ensure repeatability, safe approvals, and reliable auditing. This design prioritizes portability, testability (mockable providers), and minimal runtime assumptions by keeping the core headless and side-effect free.
8
+
-**Workflows** (data-only PSD1 files) declare what should happen,
9
+
-**Steps** implement provider-agnostic, idempotent convergence logic, and
10
+
-**Providers** adapt to external systems and manage authentication.
11
+
12
+
The engine first builds a **deterministic, auditable execution plan** from a LifecycleRequest and a workflow (Plan → Execute). **Planning validates** conditions, inputs, and required provider capabilities; **Execution runs** only the produced plan to ensure repeatability, safe approvals, and reliable auditing.
13
+
This design **prioritizes portability, testability (mockable providers), and minimal runtime assumptions** by keeping the core headless and side-effect free.
9
14
10
15
This page explains the **big picture**: responsibilities, trust boundaries, and how the core artifacts fit together.
11
16
12
17
## Start here
13
18
14
19
- If you want to **run IdLE now**: start with [Quick Start](../use/quickstart.md).
15
-
- If you want the full end-to-end flow: follow the **Walkthrough**:
20
+
- If you want the **full end-to-end flow**: follow the **Walkthrough**:
-Specification: [Use → Workflows](../use/workflows.md) and [Reference section](../reference/steps.md).
92
97
93
98
### Providers
94
99
95
-
Workflows may reference providers by alias (for example: `With.Provider = 'Identity'`), but the actual provider instances are supplied by the host.
100
+
**Workflows reference providers** by alias (for example: `With.Provider = 'Identity'`), but the actual provider instances are supplied by the host. Providers implement step capabilities specifically for each endpoint system.
96
101
97
102
Hands-on: [Walkthrough 5: Providers and authentication](../use/walkthrough/05-providers-authentication.md).
98
103
99
104
### Declarative conditions
100
105
101
-
Workflows can include declarative conditions (data-only) to decide whether steps should run.
106
+
**Workflows can include declarative conditions** (data-only) to decide whether steps should run.
102
107
For details, use the Reference workflow documentation.
103
108
104
109
---
105
110
106
111
## Plan
107
112
108
-
A **plan** is the validated, resolved execution contract produced from a workflow and a request.
113
+
A **plan is the validated, resolved execution contract** produced from a workflow and a request.
109
114
110
115
Hands-on: [Walkthrough 3: Plan build](../use/walkthrough/03-plan-creation.md).
Copy file name to clipboardExpand all lines: docs/about/intro.md
+17-14Lines changed: 17 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,34 +9,35 @@ sidebar_label: Introduction
9
9
10
10
## Introduction
11
11
12
-
IdLE (Identity Lifecycle Engine) is a **generic, configurable orchestration framework** for identity lifecycle processes
12
+
IdLE (Identity Lifecycle Engine) is a **generic, configurable orchestration framework for identity lifecycle processes**
13
13
(Joiner / Mover / Leaver and similar cases), built for **PowerShell 7+**.
14
14
15
15
---
16
16
17
17
## Why IdLE exists
18
18
19
-
JML (joiner/mover/leavers) processes are
19
+
**JML (joiner/mover/leavers) processes** are
20
20
21
-
- error prone, especially if performed manually
22
-
- time consuming and therefore
23
-
- quite annoying for operators
21
+
-**error prone**, especially if performed manually
22
+
-**time consuming** and therefore
23
+
- quite **annoying for operators**
24
24
25
-
Self-made identity lifecycle automation often turns into long scripts that are:
25
+
**Self-made identity lifecycle automation** often turns into long scripts that are:
26
26
27
-
- tightly coupled to one environment
28
-
- hard to test
29
-
- hard to change safely
27
+
-**tightly coupled to one environment**
28
+
-**hard to test**
29
+
-**hard to change** safely
30
+
-**hard to maintain**
30
31
31
-
Identity Management Systems (IdMS) on the other side are either complex or expensive (or both of it) and then often do not care about supplementary systems that also need to be covered within the workflows.
32
+
**Identity Management Systems (IdMS)** on the other side are **either complex or expensive** (or both of it) and then often do not care about supplementary systems that also need to be covered within the workflows.
32
33
33
34
---
34
35
35
36
## Start using IdLE
36
37
37
-
- If you want to run IdLE now: start with [Quick Start](../use/quickstart).
38
-
- If you want a guided path: follow the [Walkthrough](../use/walkthrough/01-workflow-definition).
39
-
- If you want the architecture and responsibility model: read [Concepts](./concepts).
38
+
- If you want to **run IdLE now**: start with [Quick Start](../use/quickstart).
39
+
- If you want a **guided path**: follow the [Walkthrough](../use/walkthrough/01-workflow-definition).
40
+
- If you want the **architecture and responsibility model**: read [Concepts](./concepts).
40
41
41
42
---
42
43
@@ -68,4 +69,6 @@ Workflows and requests remain data-only.
**Rule:** Only trusted code should populate these extension points.
53
+
:::
49
54
50
55
These extension points may contain ScriptMethods (e.g., the `AcquireAuthSession` method on AuthSessionBroker objects) but should not contain ScriptBlock *properties* that could be confused with data.
51
56
52
57
#### AuthSessionBroker Trust Model
53
58
54
59
- The broker is a **trusted extension point** provided by the host
55
-
- It orchestrates authentication without embedding secrets in workflows
60
+
- It **orchestrates authentication** without embedding secrets in workflows
56
61
- Broker objects may contain ScriptMethods (e.g., `AcquireAuthSession`) as part of their interface
57
62
- Broker objects must **not** contain ScriptBlock properties; all logic should be in methods or direct function calls
58
-
- Authentication options passed to `AcquireAuthSession` are validated as data-only (no ScriptBlocks)
63
+
-**Authentication options** passed to `AcquireAuthSession` are validated as **data-only** (no ScriptBlocks)
59
64
60
65
## Secure defaults
61
66
62
-
IdLE applies secure defaults to reduce accidental code execution:
67
+
IdLE applies **secure defaults** to reduce accidental code execution:
63
68
64
69
- Workflow configuration is loaded as data and ScriptBlocks are rejected.
65
70
- Step registry handlers must be function names (strings); ScriptBlock handlers are rejected.
@@ -91,7 +96,7 @@ Redaction happens for:
91
96
92
97
### Where redaction is applied
93
98
94
-
Redaction is intentionally centralized at output boundaries to keep the execution model unchanged and to avoid altering step/provider behavior while making outputs safe-by-default.
99
+
**Redaction is intentionally centralized** at output boundaries to keep the execution model unchanged and to avoid altering step/provider behavior while making outputs safe-by-default.
95
100
96
101
Redaction is applied **before** data is:
97
102
@@ -107,7 +112,7 @@ Redaction is applied **before** data is:
107
112
108
113
## Guidance for hosts
109
114
110
-
- Keep workflow files in a protected location and review them like code (even though they are data-only).
111
-
- Load step and provider modules explicitly before execution.
112
-
- Treat the step registry as privileged configuration and do not let workflow authors change it.
115
+
-**Keep workflow files in a protected location** and review them like code (even though they are data-only).
116
+
-**Load step and provider modules explicitly** before execution.
117
+
- Treat the **step registry as privileged configuration** and do not let workflow authors change it.
113
118
- If you stream events, implement a small sink object with a `WriteEvent(event)` method and keep it side-effect free.
# Import meta module (bootstraps module discovery for repo layout)
80
+
# Import meta module
81
81
Import-Module ./src/IdLE/IdLE.psd1 -Force
82
82
```
83
83
84
-
After importing from source, you can import additional modules by name:
84
+
:::info
85
+
The meta module bootstraps module discovery for the repository layout. Avoid using this in parallel with an IdLE installation from the PowerShell Gallery.
86
+
After importing from source, you can import additional modules by name.
0 commit comments