ADR 0005 LDAP Identity

ADR 0005 — FreeIPA directory identity binding

Status: Accepted
Date: 2026-08-03
Milestone: Phase 2 (directory)

---

Context

Face recognition returned a free-form CPAI userid that became AO session headers with no directory binding. FreeIPA is the LAN identity store; biometrics must not live in LDAP.

---

Decision

1. AO/COMSTAR session only — not Kerberos SSO or HA presence in this ADR.
2. FreeIPA uid is the canonical session identity.
3. comstarFaceId / comstarVoiceId bind biometric store IDs to that uid.
4. Biometrics stay in CPAI / future speaker service.
5. Bridge resolves faceId → profile via directory sidecar before OpenSession.
6. Fail closed when directory.require: true.
7. Planner LDAP MCP deferred (guest_allowed: false when added).

Full text: docs/adr/0005-ldap-identity.md in the main repo.

---

Related

• Directory Identity
• Vision & Face Enrollment
• ADR Index