Directory Identity

Directory Identity (FreeIPA)

COMSTAR auto-login resolves a biometric match to a FreeIPA person before opening an AO session. Design: ADR 0005 in the main repo (docs/adr/0005-ldap-identity.md, docs/ldap/).

Binding model

Store	Field	Role
FreeIPA	uid	Canonical AO / COMSTAR session identity
FreeIPA	displayName / cn	Greeter + kiosk name
FreeIPA	comstarFaceId	CPAI enroll/recognize string (default = uid)
FreeIPA	comstarVoiceId	Reserved for future speaker ID
CodeProject.AI	face embeddings	Biometrics — not in LDAP

Resolve path

1. Vision poll → CPAI face/recognize → biometric faceId
2. Vote resolver locks faceId
3. Bridge calls directory sidecar GET /v1/resolve?face_id=…
4. Session opens as FreeIPA uid with LDAP displayName

When directory.enabled: false, faceId is used as uid (legacy / bring-up). When directory.require: true and LDAP misses, the face is treated as unknown.

Enroll

./scripts/enroll_face.sh <ipa-uid>

Verifies the IPA user, sets comstarFaceId (default = uid), registers that id with CPAI. Use COMSTAR_SKIP_LDAP=1 only for camera bring-up without FreeIPA.

Related

• Vision & Face Enrollment
• What is COMSTAR — Identity is load-bearing
• Security