validate

Checks every user in a CMF file against the target’s Capabilities() — which password algorithms and MFA types it accepts — before any API call is made. Catches an unsupported hash algorithm or a portable MFA type the target can’t import (for Auth0: webauthn and recovery_codes are never portable; for Kratos: only bcrypt/argon2 password hashes and totp/recovery_codes MFA are supported; for Keycloak: only pbkdf2/argon2 password hashes and totp MFA are supported) early, rather than failing mid-import.

Usage

iamigrate validate --in users.cmf.jsonl.gz --mapping mapping.yaml --target auth0
# or
iamigrate validate --in users.cmf.jsonl.gz --target kratos
# or
iamigrate validate --in users.cmf.jsonl.gz --target keycloak

Flags

Flag	Description
--in	CMF users.cmf.jsonl.gz path (required)
--mapping	mapping.yaml path (optional)
--target	Target connector name: auth0 | kratos | keycloak (required)

Exits non-zero and lists every problem found if validation fails.