<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-identity-fabric-architecture
description: >-
  Design and implement identity fabric architecture that unifies identity services across cloud, on-premises, and hybrid environments. Covers identity orchestration, protocol bridging (SAML/OIDC/SCIM), decentralized identity integration, identity mesh patterns, and zero-trust identity verification across distributed systems.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-fabric
  - identity-orchestration
  - SAML
  - OIDC
  - SCIM
  - zero-trust
  - decentralized-identity
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "PR.AC-1"
  - "PR.AC-3"
  - "PR.AC-5"
  - "PR.AC-6"
  - "PR.AC-7"
  frameworks:
  - "NIST SP 800-63"
  - "Zero Trust Architecture"
  - "SCIM 2.0"
  - "OpenID Connect"
  - "SAML 2.0"
  mitre-attack: ["T1078"]
---

# Implementing Identity Fabric Architecture

## Overview

Identity fabric architecture creates a unified identity layer that abstracts
underlying identity providers, protocols, and directories into a cohesive service
mesh. It enables consistent authentication, authorization, and lifecycle management
across hybrid cloud environments while supporting protocol translation and
decentralized identity models.

## Workflow

1. **Identity Landscape Discovery** — Inventory all identity providers, directories, protocols, and trust relationships
2. **Architecture Pattern Selection** — Choose identity mesh, hub-and-spoke, or federated model based on requirements
3. **Protocol Bridge Design** — Map protocol translation requirements (SAML↔OIDC, LDAP→SCIM, Kerberos→OAuth)
4. **Orchestration Layer** — Deploy identity orchestration engine for adaptive authentication flows
5. **Directory Synchronization** — Configure real-time sync between on-premises AD, cloud IdPs, and HR systems
6. **Policy Engine Integration** — Implement centralized access policies with context-aware evaluation
7. **Lifecycle Automation** — Build joiner-mover-leaver workflows with cross-platform provisioning
8. **Monitoring and Governance** — Deploy identity analytics for fabric health, latency, and anomaly detection

## Key Concepts

### Identity Fabric Components

| Component | Function | Technologies |
|-----------|----------|-------------|
| Identity Orchestration | Adaptive auth flows | Ping, ForgeRock, Azure AD |
| Protocol Bridge | Translate between standards | SAML↔OIDC, Kerberos→OAuth |
| Directory Services | Identity store | AD, Azure AD, LDAP, Okta UD |
| Provisioning Engine | Lifecycle automation | SCIM 2.0, HR-driven workflows |
| Policy Decision Point | Access evaluation | OPA, Azure CA, Ping Authorize |
| Identity Governance | Certifications and reviews | SailPoint, Saviynt |
| Decentralized Identity | Verifiable credentials | DID, VC, ION |

### Architecture Patterns

| Pattern | Description | Use Case |
|---------|-------------|----------|
| Hub-and-Spoke | Central IdP federates to all apps | Single enterprise, cloud migration |
| Identity Mesh | Peer-to-peer trust between IdPs | Multi-cloud, M&A integration |
| Federated | Distributed trust with standards | B2B partnerships, consortiums |
| Hybrid Bridge | On-prem AD + cloud IdP unified | Legacy modernization |

### Protocol Comparison

| Feature | SAML 2.0 | OIDC | SCIM 2.0 | FIDO2 |
|---------|---------|------|---------|-------|
| Primary Use | SSO | SSO + API auth | Provisioning | Passwordless |
| Token Format | XML assertion | JWT (id_token) | JSON | Authenticator |
| Transport | HTTP POST/Redirect | HTTP REST | HTTP REST | WebAuthn API |
| Mobile Support | Limited | Native | N/A | Platform keys |
| MFA Integration | Via IdP | Via IdP | N/A | Built-in |

## Detection Opportunities

### Identity Fabric Threat Indicators

- **Protocol downgrade**: OIDC to SAML fallback exploitation
- **Token replay**: JWT or SAML assertion reuse across trust boundaries
- **Sync poisoning**: unauthorized modifications propagated through directory sync
- **Orchestration bypass**: authentication flow manipulation to skip MFA steps
- **MITRE mapping**: T1078 (Valid Accounts), T1550.001 (Application Access Token), T1556 (Modify Authentication Process)

```yaml
title: Detect Identity Fabric Bypass — Direct AD Authentication Without SSO
id: d6e7f8a9-b0c1-2345-defa-456789012345
status: experimental
description: Detects authentications directly to Active Directory that bypass the identity fabric SSO layer.
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'NTLM'
  filter_expected:
    SubjectUserName|endswith: '


  condition: selection and not filter_expected
falsepositives:
  - Legitimate administrative activity from authorized accounts
level: medium
tags:
  - attack.t1550.002
  - attack.credential_access
```

