A from-scratch control plane that provisions a hire across Okta → Active Directory → TrueNAS + Proxmox, a managed laptop, training, and SaaS in one call — deprovisions same-day and proves it, gates sensitive data on current training, and tracks licence spend, equipment, inventory, vendors, and safety. All audited.
A hire created in Okta is pushed into AD by an idempotent SCIM sync; their group membership decides their ACLs on storage and compute. To decide "can she start VM 101?", LabSuite resolves her effective AD groups — following nested groups — and checks the Proxmox ACL on that VM's path.
Source of truth for users and group membership. Authenticates and issues a signed session token.
Synced from Okta. Owns the permission structure — including nested groups resolved by transitive closure.
Shares whose ACLs map an AD group to read / modify / full.
VMs with hierarchical (path, group) → role ACLs.
One call creates the hire in Okta, assigns role/department groups by policy, syncs to AD, and reports the exact TrueNAS + Proxmox access they now have.
Same-day deprovision across the whole chain — and it proves zero residual access before returning.
Okta → AD reconcile with create / update / deactivate. Run it twice; the second run is a provable no-op.
A researcher gets GPU access because Research is nested in GPU-Cluster-Users — inherited, not hand-granted.
Every decision records the exact groups that granted it. Nothing happens off the record.
A quarterly-style report flags stale access, FULL on sensitive shares, and datacenter-wide admin.
Onboarding images and ships a managed laptop per role (encryption, MDM, Okta MFA, Iru/Ansible); offboarding flags it wipe & return.
Sensitive lab data stays locked until IACUC + biosafety training is current — and auto-revokes the moment it lapses.
Sensitive shares require Okta Verify regardless of group membership — conditional access that composes with the training gate.
Corp / Lab / IoT / Guest / Mgmt VLANs with a default-deny east-west policy; a camera on the wrong VLAN gets flagged automatically.
Turn the access review into a certify/revoke campaign with tracked completion — the artifact a SOC 2 / ISO 27001 auditor asks for.
Just-in-time elevation into powerful groups that self-expires — nobody carries standing datacenter admin.
SaaS spend by department against budget, and backup/DR health per dataset and VM with stale-backup flags.
One inbox rolls up every outstanding flag — lapsed training, MFA gaps, overdue maintenance, low stock, renewals, segmentation misconfigs, stale backups, budget overruns — each a click from its fix.
Who has what and what it costs, plus equipment maintenance, inventory, vendor renewals, and facility safety — one source of truth.
Each layer sits behind an interface. Drop in the real Okta / AD / TrueNAS / Proxmox / MDM APIs without touching the control plane.
Pure Python. Runs anywhere, in CI, on 3.10–3.12. FastAPI only for the optional live API.
Drive it from the terminal, an OIDC-ish HTTP API with a SCIM feed, or this web dashboard.
Every operational view was driven end-to-end in the live dashboard — desktop and mobile, demo and API-backed. Backed by 137 automated tests, ruff-clean, on Python 3.10–3.12.
# Python 3.10+; the core needs no third-party packages.
python3 -m venv .venv && source .venv/bin/activate
pip install -e . # add ".[api]" for the live API + GUI
labsuite demo # the whole story, end to end
labsuite onboard --name "Nadia Rahman" --department Research --role research-scientist
labsuite access --user nrahman
labsuite check --user nrahman --system proxmox --resource 101 --action vm.power
labsuite offboard --user nrahman # same-day, verified clean
labsuite review # access review + flagsLabSuite is a faithful reference implementation — a simulator of the stack and the processes around it, shaped so each layer can be swapped for the real product's API.