In enterprise security, identity records should never originate directly inside target directories like Active Directory or Okta. Instead, a central Human Resources database serves as the authoritative Single Source of Truth (SSOT). Here is a deep dive into the design, constraints, and PowerShell interaction mechanics of hr_system.db hosted on server APP1.
Ad-hoc identity provisioning leads to "ghost accounts," inconsistent user attributes, and delayed offboarding. By enforcing an upstream Human Resources (HR) system as the authoritative origin, downstream systems automatically reflect real-world employment state transitions.
HR records (hr_system.db) → Automation Engine (APP1) → Active Directory (DC1) → Cloud IdP (Entra ID / Okta). Access is systematically granted or revoked based on database updates.
SQLite provides a zero-configuration, serverless, self-contained relational database file (C:\IAM_Automation\hr_system.db). It supports full SQL syntax, table constraints, and seamless PowerShell interaction without complex RDBMS overhead.
The database schema is structured around two core operational requirements: maintaining clean identity profiles and recording immutable execution audit entries.
Core employee records in hr_system.db defining user states (Active, Transferred, Terminated).
The jml_sync_log table logging every Joiner, Mover, and Leaver execution timestamp and status detail.
Strict column constraints ensure data integrity prior to executing Active Directory commands:
-- Core Employee Table CREATE TABLE IF NOT EXISTS employees ( employee_id INTEGER PRIMARY KEY AUTOINCREMENT, first_name TEXT NOT NULL, last_name TEXT NOT NULL, user_principal_name TEXT UNIQUE NOT NULL, department TEXT NOT NULL, job_title TEXT NOT NULL, status TEXT CHECK(status IN ('Active', 'Transferred', 'Terminated')) NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP ); -- Execution Log Table for Audit & HTML Reporting CREATE TABLE IF NOT EXISTS jml_sync_log ( log_id INTEGER PRIMARY KEY AUTOINCREMENT, employee_id INTEGER, action_type TEXT NOT NULL, status TEXT NOT NULL, details TEXT, timestamp DATETIME DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY(employee_id) REFERENCES employees(employee_id) );
The synchronization script Invoke-HRIdentitySync.ps1 uses the lightweight PSSQLite module to execute parameterized queries against hr_system.db directly in memory.
# Import module & set path Import-Module PSSQLite $dbPath = "C:\IAM_Automation\hr_system.db" # Query all active employees to drive Joiner logic $activeUsers = Invoke-SqliteQuery -Database $dbPath -Query "SELECT * FROM employees WHERE status = 'Active'" # Insert execution audit entry $logQuery = "INSERT INTO jml_sync_log (employee_id, action_type, status, details) VALUES (1, 'JOINER', 'SUCCESS', 'Account provisioned')" Invoke-SqliteQuery -Database $dbPath -Query $logQuery
Live console query output on host APP1 showing direct evaluation of the employees table via Invoke-SqliteQuery.
Decoupling HR business logic into an upstream SQLite database allows seamless updates to employee lifecycle states without modifying core Active Directory synchronization logic.
Explore Related Identity & Access Management Modules: