Module integrations 

Drivers that apply a rotation to the external system holding the credential.

Each target system kind has one Integration, registered against its [SealedTargetSystemKind] in an IntegrationRegistry. For a claimed rotation the executor looks up the driver for the target’s kind and calls it in order:

1. rotate sets the account’s password to the newly generated one.
2. verify confirms the target accepted it, after a successful rotate.
3. terminate_sessions ends the account’s active sessions, only when the claim asks for it. Its failure never fails the rotation.

All three receive the same RotateContext: the target, the account identity, the new password and the target’s ResolvedCredentials.

Drivers rotate by administrative reset. The current password is never available to them, so a retry after a partial failure converges on the newest password instead of failing because the “old” one has already changed.

Failures

An operation fails with an IntegrationError, which carries everything the failure report needs: whether to Retry, the [RotationFailureCode], a SafeDetail, and the TargetEffect on the credential in the target. The effect becomes the reported [RotationSyncState], which tells the vault whether it is still in sync with the target. A driver that cannot tell whether a change landed must report TargetEffect::Unknown rather than guess.

Drivers

• active_directory: on-premises Active Directory, over LDAPS.
• entra: Microsoft Entra ID, through Microsoft Graph.
• scripting: an operator-supplied script, run directly or through a PowerShell host.

Operator-facing behaviour (required credentials, permissions, the script contract) is documented in the crate README.

Modules

active_directory 🔒

On-premises Active Directory, rotated by an administrative reset of the account’s unicodePwd over LDAPS.

entra 🔒

Microsoft Entra ID (Azure AD) integration.

scripting 🔒

Rotation through an operator-supplied script, run directly or through a PowerShell host.

Structs

IntegrationError 🔒

An error returned by any Integration operation, carrying what the failure report needs.

IntegrationRegistry 🔒

Maps a [SealedTargetSystemKind] to its Integration driver. Kinds without a registered integration return None, which the executor reports as unsupported_kind.

RotateContext 🔒

Input to every Integration operation, built from the claim and the resolved credentials.

Enums

TargetEffect 🔒

Effect of a failed operation on the target credential, mapped to a [RotationSyncState].

Traits

Integration 🔒

Trait implemented by each target-system driver, such as Entra or CustomScript.