SCIM Provisioning and Workforce Lifecycle

Deleting a person from the corporate directory must not wait for their next login, and a successful OIDC login must not silently create every role. System for Cross-domain Identity Management (SCIM) is an HTTP-based provisioning protocol for users and groups; it manages lifecycle state, not authentication or delegated API authorization.

Today you will create one user, patch one membership, deactivate the user, retry idempotently, preserve Bob as the unaffected control, and clean the fixture. Missing AUTH-R04 routes to Day 04 because the internal identity link must remain distinct from provisioning state.

Northstar needs Alice's deactivation to remove current eligibility while retaining reviewable identity and audit references. The outcome is AUTH-R05, a versioned lifecycle receipt for Day 06; it does not prove enterprise-directory compatibility or production deprovisioning latency.

The corporate directory owns workforce truth. The SCIM service runtime validates an independently authorized provisioning client and reconciles internal user and membership state. PostgreSQL owns external IDs, versions, active status, and team membership; the login provider still owns authentication.

Use the directory's stable external identifier, validate schema and version preconditions, and make retries converge. Deactivation sets active: false, invalidates current memberships and relevant sessions under policy, but preserves the audit reference required for investigation.

POST /scim/v2/Users
PATCH /scim/v2/Groups/{group-id}
PATCH /scim/v2/Users/{user-id}
If-Match: W/"version-3"

RFC 7643 defines the SCIM core schema and RFC 7644 defines protocol operations including create, query, patch, and bulk behavior. The provisioning client's OAuth token authorizes SCIM calls; SCIM itself does not authenticate Alice to HelixWorks.

The unscored activity creates Alice from a disposable fixture, adds Procurement, removes it, deactivates Alice, repeats the final request, and confirms Bob remains active. Reject stale If-Match to prove concurrent state is not overwritten silently.

The scored check supplies one current record and one event; the single unknown is the legal next lifecycle transition. Treating SCIM as SSO triggers feedback that replays the same deactivation while no browser login occurs. Declined candidates include real directory writes, attribute catalogues, immediate-global-revocation claims, and combining membership mapping with role-policy design.

Record external ID, internal user ID, membership IDs, prior/new versions, active state, idempotency key, expected/observed result, stale-write denial, Bob control, environment, timestamp, immutable trace ID, and cleanup as AUTH-R05. Day 06 combines this lifecycle input with the separate OAuth grant and OIDC identity contracts.