Fleetworks · Directory
One read-only cache of who is who
Rolodex mirrors your Active Directory people and groups into one cache, answers lookups through a REST API, and turns group membership into access on GitHub, Azure DevOps and GitLab.
What the directory holds
One global set of people and groups. It belongs to no Org, and every row is private until someone publishes it.
- 01
Directory user
A person or machine account, found by sAMAccountName, distinguishedName, objectGUID, DSS username or employee number.
- 02
Directory group
A named group whose membership is always a set of directory users. Nested groups are expanded to their leaf users.
- 03
Directory service account
A directory user marked as a non-human account, with an environment and a loose YellowPages service ID.
- 04
Synced row
A row a sync source owns and updates. A user who leaves upstream is kept as an inactive tombstone, never deleted.
- 05
Native row
A user or group Rolodex itself created. No sync ever touches it.
- 06
Mode
A chmod-style permission on each user and group. Only the view bits are enforced today; publishing sets the other-view bit.
What Rolodex does
- 01
Directory lookups
The LDAP Sync Cache contract: find a directory user by any of five identifiers, search, list, and get groups with nested groups expanded.
- 02
SSH keys lookup
Fetch the public SSH keys of one directory user, or of every member of a directory group, by name.
- 03
Directory sync
Sync sources feed the directory. Each sync run upserts users and groups and keeps users who left as inactive tombstones.
- 04
Public surface
Publish chosen users and groups to an unauthenticated search, with every personal field removed.
- 05
Access provisioning
Bind a directory group to a team, repo, project or group path, and a reconciler turns membership into grants on GitHub, Azure DevOps or GitLab.
- 06
Signed webhooks
An Org registers endpoints and receives signed events after each change commits, delivered at least once.
Lookups are one request away
The public surface needs no credentials and returns only published rows, without their personal fields. Directory lookups need a signed-in person with the org:contributor role or above. The API describes itself at /openapi.json.
# published rows, no credentials
curl "https://rolodex-api.fleetworks.dev/public/search?q=platform&type=groups"
# signed in, org:contributor or above
curl -H "Authorization: Bearer $TOKEN" \
https://rolodex-api.fleetworks.dev/api/ldap-sync-cache/user/jdoeFrom an upstream directory to answers
- Step 1
Configure a sync source
An admin adds an AD/LDAP sync source to an Org: the server URL, the base DN, the bind DN and optional user and group filters.
- Step 2
Sync runs fill the directory
Each sync run upserts users and groups and tombstones users who are gone. A scheduled drain or an admin starts the run.
- Step 3
Publish what should be public
Every row starts private. An admin publishes a user or group, and only then does it appear on the public surface, without personal fields.
Look up anyone in your directory
Sign in with your Fleetworks account, or start with the public surface, which needs no account.