synitio/ad-proxy repository overview

⁠Synit AD Proxy

A governed control plane for day-to-day Active Directory operations. Instead of spreading LDAP write logic and privileged credentials across scripts and workflow systems, teams get one HTTP API that plans changes first, applies them only after approval, verifies the final state, and keeps a journal for audit and recovery.

• Plan before apply: every mutation returns ordered actions, dependencies, risk markers, a rollback preview, and a plan ID before anything is written.
• Write-time approval: sensitive operations require explicit approval when the write happens, not in advance.
• Verify and journal: after the write, the end state is measured and the outcome recorded, distinguishing confirmed success, rejection, partial completion, and uncertainty.
• One boundary, many callers: HTTP JSON, JSON-RPC 2.0, webhook flow, and JSONata templates for onboarding and offboarding workflows.

It is a technical control plane, not an identity governance suite, PAM, SIEM, or AD disaster recovery. Mutation semantics are transaction-like with best-effort rollback, not ACID.

⁠Quick start

docker pull synitio/ad-proxy:latest

The container expects an HCL configuration mounted read-only, with secrets passed by environment variable references. Validate first, then serve:

docker run --rm -v ./adproxy.hcl:/etc/adproxy/adproxy.hcl:ro \
  synitio/ad-proxy:latest validate-config -config /etc/adproxy/adproxy.hcl

Configuration, TLS, tokens, audit, and snapshot setup are covered in the getting started guide⁠. Start with a disposable OU and plan-only traffic before the first production write.

⁠Tags and platforms

Linux images for amd64, arm64, and arm/v7. Use a pinned version tag and record the image digest for reproducible deployments; latest is a moving tag.

⁠Documentation

• Product page⁠
• Getting started⁠
• Plan/Apply model⁠
• Configuration⁠
• Configuration reference⁠
• API and templates⁠
• Operations and boundaries⁠
• Troubleshooting⁠
• Upgrade to v0.1.0⁠

⁠Related image

Agents that only need directory context should use the separate read-only MCP server, synitio/ad-mcp⁠. It cannot write to AD by design.

⁠License and use

Internal use, including production, is free of charge under the product license. External hosting, managed-service, reseller, and other commercial-service use requires prior written permission. Details: license and use⁠.

Questions or a pilot: synit.io/kontakt⁠