Skip to content
IdentityScribe

Architecture

IdentityScribe bridges LDAP directories with modern APIs. It synchronizes data from LDAP sources into PostgreSQL, then serves queries through multiple protocol channels.

System overview

Section titled “System overview”
flowchart LR
    subgraph sources[LDAP Sources]
        AD[Active Directory]
        OpenLDAP[OpenLDAP]
        Other[Other LDAP]
    end
    
    subgraph scribe[IdentityScribe]
        Ingest[Ingest]
        PG[(PostgreSQL)]
        Query[Query]
    end
    
    subgraph channels[Channels]
        LDAP[LDAP v3]
        REST[REST API]
        GQL[GraphQL]
    end
    
    sources --> Ingest
    Ingest --> PG
    PG --> Query
    Query --> channels

How it works

Section titled “How it works”

Ingest: LDAP to PostgreSQL

Section titled “Ingest: LDAP to PostgreSQL”
  1. Detect - Listen for changes via persistent search, changelog, or polling (per-LDAP best method)
  2. Transform - Apply attribute mappings and virtual attributes
  3. Store - Write change events to PostgreSQL
  4. Index - Update search indexes

Query: PostgreSQL to clients

Section titled “Query: PostgreSQL to clients”
  1. Parse - Convert client query (LDAP filter, REST params) to SQL
  2. Execute - Run optimized SQL against PostgreSQL
  3. Map - Transform results to channel format (LDAP entries, JSON, GraphQL)

Channels

Section titled “Channels”

All channels share the same query engine, ensuring consistent behavior:

ChannelProtocolUse case
LDAPLDAP v3Legacy apps, LDAP tools
RESTHTTP/JSONModern apps, automation
GraphQLHTTP/GraphQLFlexible queries, frontend-driven data fetching

Key concepts

Section titled “Key concepts”

Transcribes

Section titled “Transcribes”

A transcribe defines what to sync from an LDAP source:

  • base - LDAP subtree to sync (e.g., ou=users,dc=example,dc=com)
  • filter - Which entries to include (e.g., (objectClass=person))
  • attributes - Attribute mappings and transformations

Event store

Section titled “Event store”

All changes are stored as immutable events:

  • Full history - Every change to every entry is recorded
  • Point-in-time queries - Query data as it existed at any moment
  • Efficient sync - Incremental updates from source LDAP

Next steps

Section titled “Next steps”