RFC-PAM-0002                                                    Section 8
Category: Standards Track                           Group Synchronisation

pn-access makes each host agree with Entra: which local users belong to which tier groups, and which accounts should still exist. It is the mechanism behind the authorization tiers (Section 6) and decommissioning (Section 9). Arc provisions the account at first login; pn-access governs everything about it afterwards.

8.2 Authentication — No Secrets on the Host

The agent uses the host's Arc system-assigned managed identity (token obtained from the Arc agent's local identity endpoint) to read Microsoft Graph. Each host identity is granted, via Terraform, a read-only group-membership permission and nothing more. There is no client secret, no key file, nothing to rotate or leak. A compromised host yields group memberships — low sensitivity — and nothing else.

8.3 Inputs

Input	Source	Owner
The host's class	`pn_class` Arc tag	Terraform
Members of the `pn-host-*` groups relevant to that class	Microsoft Graph	Entra
Entra group → Linux group map; retention window	root-owned file under `/etc/pn-access/`, Ansible-managed	ovh-infra PR

Example map entries: pn-host-operator → pn_operator; pn-host-editor-prod → deploy, pn_deployer; pn-host-deployer-prod → pn_deployer.

8.4 Each Cycle (every 5 minutes; idempotent)

Step	Action
1	Reconcile tier group membership for every Arc-provisioned human account on this host
2	For a person no longer in any tier for this class: terminate their sessions; lock and expire the account (Invariant 8, ≤5 min)
3	For accounts locked more than 30 days: archive the home directory to the retention location; re-own their files in shared trees to `deploy`; remove the user
4	Emit a heartbeat to Sentinel: accounts present vs. Entra membership, actions taken, errors

The 30-day window is a retention/reversibility choice, not a security one — from minute five the account is inert (no password, no keys, Arc login denied). Holding the UID for 30 days also prevents a new user silently inheriting ownership of leftover files.

8.5 What It Never Does

Create accounts (Arc does that at first login).
Touch root, the deploy service user, system accounts, or automation identities — it manages only Arc-provisioned humans (identified by the extension's account naming and UID range).
Write to Entra.

8.6 Fail-Safe Rules (Invariant 10)

Condition	Behaviour
Graph unreachable, throttled or ambiguous	change nothing; log; alert after three consecutive misses
Map file missing or malformed	refuse to run; alert
Agent silent (no heartbeat)	Sentinel alert; login gating is unaffected because Azure denies logins independently

Removing access on an error would be worse than a delay; Azure already gates logins on its own.

8.7 Why Per-Host Rather Than a Central Sync Service

No single point of failure, no new service to run, and the permission each identity holds is trivially small. A central function would add a component just to hold one Graph permission and would make every host depend on it (Section 12.6).

8.8 Ownership

One Ansible role (pn-access) in ovh-infra alongside pn-deploy and the host access policy — the existing delivery path, reviewed by PR.

Previous	Index	Next
← 7. Deploy Action	Table of Contents	9. Decommissioning →

End of Section 8

8. Group Synchronisation