Feature
Zitadel reconciliation
Tie each Zitadel account to a directory user, so an inactive or absent sign-in account can hold its person out of access grants.
A reconciliation run places each Zitadel user on a directory user through the match ladder: by verified email, then by sAMAccountName. An operator can also link by hand, and a manual link is never re-evaluated.
Duplicate claims and unmatched accounts go to a review queue. When a linked Zitadel account is inactive or absent, that is a Zitadel denial: the person is screened out of every desired set. Zitadel can deny, but never grant.
A circuit breaker holds back all revocations in a run when too many links would be revoked at once. These routes need a platform principal, not an Org role.
More features
All features →- 01
Directory lookups
The LDAP Sync Cache contract: find a directory user by any of five identifiers, search, list, and get groups with nested groups expanded.
- 02
SSH keys lookup
Fetch the public SSH keys of one directory user, or of every member of a directory group, by name.
- 03
Directory sync
Sync sources feed the directory. Each sync run upserts users and groups and keeps users who left as inactive tombstones.