> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity Fabric

Every organization has an identity fabric -- it's the collection of identity providers, directories, and authentication systems that together determine who can access what. For most enterprises, this fabric is not a single system. It's Entra ID for cloud apps, Active Directory for on-prem resources, an LDAP directory for legacy systems, maybe Okta or PingFederate from an acquisition. Different protocols, different vendors, different eras of technology -- all serving the same fundamental purpose.

The Maverics Orchestrator connects to your identity fabric through **connectors**. Each connector integrates with one identity provider or attribute source, abstracting the protocol details (OIDC, SAML, LDAP) behind a uniform interface. This means the Orchestrator can authenticate users against any provider, pull attributes from any directory, and translate between protocols -- without your applications knowing or caring which systems are involved upstream.

> [!NOTE]
>
> **Console terminology:** In the Maverics Console, this section is called
> **Identity Fabric**. The YAML configuration uses the `connectors` key to define
> identity provider integrations.

## Available Connectors

The Orchestrator ships with connectors for the identity providers and directories enterprises use most.

| Connector | Protocol | Use Case |
| - | - | - |
| [1Kosmos (SAML)](/reference/orchestrator/identity-fabric/onekosmos) | SAML | 1Kosmos passwordless MFA |
| [Amazon Cognito (OIDC)](/reference/orchestrator/identity-fabric/cognito) | OIDC | Cognito user pool SSO, AWS identity |
| [Auth0 (OIDC)](/reference/orchestrator/identity-fabric/auth0) | OIDC | Auth0 SSO federation, tenant migration |
| [Continuity](/reference/orchestrator/identity-fabric/continuity) | Failover aggregation | IdP failover, zero-downtime migration |
| [Generic OIDC](/reference/orchestrator/identity-fabric/custom-oidc) | OIDC | Any OIDC-compliant provider |
| [Generic SAML](/reference/orchestrator/identity-fabric/custom-saml) | SAML 2.0 | Any SAML-compliant provider |
| [CyberArk (OIDC)](/reference/orchestrator/identity-fabric/cyberark) | OIDC | CyberArk Identity SSO |
| [CyberArk (SAML)](/reference/orchestrator/identity-fabric/cyberark-saml) | SAML 2.0 | CyberArk Identity SAML federation |
| [Duo (SAML)](/reference/orchestrator/identity-fabric/duo) | SAML 2.0 | Duo Security MFA federation |
| [Google Workspace (OIDC)](/reference/orchestrator/identity-fabric/google-workspace) | OIDC | Google Workspace SSO (uses generic OIDC) |
| [HYPR](/reference/orchestrator/identity-fabric/hypr) | HYPR | HYPR passwordless authentication |
| [Keycloak (OIDC)](/reference/orchestrator/identity-fabric/keycloak) | OIDC | Keycloak SSO federation |
| [LDAP Authentication](/reference/orchestrator/identity-fabric/ldap) | LDAP/LDAPS | LDAP bind authentication for end users |
| [LDAP Attribute Provider](/reference/orchestrator/identity-fabric/ldap-attr) | LDAP/LDAPS | LDAP attribute lookups for enrichment |
| [Microsoft Active Directory](/reference/orchestrator/identity-fabric/activedirectory) | LDAP (via AD) | Active Directory integration |
| [Microsoft ADFS (SAML)](/reference/orchestrator/identity-fabric/adfs) | SAML 2.0 | ADFS-to-cloud migration, hybrid federation |
| [Microsoft Entra ID (OIDC)](/reference/orchestrator/identity-fabric/azure-ad) | OIDC | Entra ID SSO, hybrid identity |
| [Microsoft Entra ID (SAML)](/reference/orchestrator/identity-fabric/entra-id-saml) | SAML 2.0 | Entra ID SAML-based federation |
| [Microsoft Entra ID Attribute Provider](/reference/orchestrator/identity-fabric/entra-id-attr) | Graph API | Entra ID attribute enrichment via Microsoft Graph |
| [Microsoft Windows Client Authenticator](/reference/orchestrator/identity-fabric/wca) | Windows auth | Windows desktop credential authentication via IIS |
| [Okta (OIDC)](/reference/orchestrator/identity-fabric/okta) | OIDC | Okta SSO consolidation, legacy app bridging |
| [Okta (SAML)](/reference/orchestrator/identity-fabric/okta-saml) | SAML 2.0 | Okta SAML-based federation |
| [Okta Attribute Provider](/reference/orchestrator/identity-fabric/okta-attr) | Okta API | Okta attribute enrichment via API |
| [Oracle Identity Cloud Service (OIDC)](/reference/orchestrator/identity-fabric/oracle-ics) | OIDC | Oracle IDCS SSO |
| [Oracle Universal Directory (LDAP)](/reference/orchestrator/identity-fabric/oracle-oud) | LDAP/LDAPS | Oracle OUD directory integration |
| [PingFederate (OIDC)](/reference/orchestrator/identity-fabric/pingone) | OIDC | PingFederate on-premises federation |
| [PingFederate (SAML)](/reference/orchestrator/identity-fabric/pingfederate-saml) | SAML 2.0 | PingFederate SAML-based federation |
| [Trusona (OIDC)](/reference/orchestrator/identity-fabric/trusona) | OIDC | Trusona identity verification |
| [WSO2 Identity Server (OIDC)](/reference/orchestrator/identity-fabric/wso2) | OIDC | WSO2 Identity Server SSO |

## Mode Compatibility

Identity Fabric connectors work with all five Orchestrator modes. The connector determines which protocol the Orchestrator uses to communicate with your **identity provider**. The mode determines which protocol the Orchestrator uses to communicate with your **application**. These are independent -- an OIDC connector can feed a SAML Provider mode app, and a SAML connector can feed an OIDC Provider mode app. The Orchestrator handles all protocol translation.

* **OIDC connectors** (Microsoft Entra ID, Okta, Auth0, PingFederate, Amazon Cognito, Generic OIDC) -- Used with all modes. Most common for OIDC Provider and HTTP Proxy.
* **SAML connectors** (Generic SAML, Microsoft ADFS, Entra ID SAML, Okta SAML, PingFederate SAML, CyberArk SAML, Duo) -- Used primarily with SAML Provider and HTTP Proxy. The Orchestrator translates SAML upstream to any downstream protocol.
* **LDAP connectors** (LDAP, Microsoft Active Directory, Oracle Universal Directory) -- Used primarily as attribute providers (enriching claims with directory data). Most common with HTTP Proxy and LDAP Provider modes.
* **Continuity connector** -- Mode-agnostic. Wraps other connectors to provide IdP failover.

See the [connector compatibility matrix](/guides/authentication/choosing-a-mode#connector-compatibility) for the full matrix showing which connectors are commonly paired with which modes.

Most connectors authenticate to the identity provider with a client ID and secret you provision ahead of time. The [Generic OAuth](/reference/orchestrator/identity-fabric/oauth) connector additionally supports two credential-less modes for authorization servers that accept them: [Dynamic Client Registration](/reference/orchestrator/identity-fabric/oauth#dynamic-client-registration), where the Orchestrator registers its own client at startup, and [Client ID Metadata Document](/reference/orchestrator/identity-fabric/oauth#client-id-metadata-document) mode, where the Orchestrator identifies itself by a URL it publishes.

## Setup

**Console UI**

To create an Identity Fabric connector in the Maverics Console:

1. Navigate to **Identity Fabric** in the Console sidebar.
2. Click **Create** to open the connector type selection dialog.
3. Select the connector type that matches your identity provider (e.g., **Microsoft Entra ID (OIDC)**, **Okta (OIDC)**, **Generic SAML**).
4. Fill in the required fields for your selected connector type -- see the individual connector pages for field-by-field instructions.
5. Click **Save**.

> [!TIP]
>
> Each connector type has its own configuration form. See the individual connector pages linked below for detailed Console UI walkthroughs specific to each provider.

**Configuration**

```yaml maverics.yaml theme={null}
connectors:
  - name: azure
    type: azure
    oauthClientID: "{{ env.AZURE_CLIENT_ID }}"
    oauthClientSecret: <vault.azure_client_secret>
    oidcWellKnownURL: "https://login.microsoftonline.com/{{ env.AZURE_TENANT_ID }}/v2.0/.well-known/openid-configuration"
    oauthRedirectURL: "https://app.example.com/callback"
    scopes: "openid profile email"
    tls: "idp-tls"
    healthCheck:
      enabled: true
      interval: "30s"
      timeout: "5s"
      healthyThreshold: 3
      unhealthyThreshold: 3

  - name: corporate-ldap
    type: ldap
    url:
      - "ldaps://ldap.example.com:636"
    serviceAccountUsername: "cn=maverics,ou=services,dc=example,dc=com"
    serviceAccountPassword: <vault.ldap_password>
    baseDN: "dc=example,dc=com"
    usernameSearchKey: "uid"
    userAttributes:
      - "cn"
      - "mail"
      - "memberOf"
    attributeMapping:
      email: "mail"
      name: "cn"
    tls: "ldap-tls"
```

## Connector Pages

> **[1Kosmos (SAML)](/reference/orchestrator/identity-fabric/onekosmos)**
>
> 1Kosmos passwordless MFA

> **[Amazon Cognito (OIDC)](/reference/orchestrator/identity-fabric/cognito)**
>
> OIDC connector for AWS Cognito user pools

> **[Auth0 (OIDC)](/reference/orchestrator/identity-fabric/auth0)**
>
> OIDC connector for Auth0 by Okta

> **[Continuity](/reference/orchestrator/identity-fabric/continuity)**
>
> Failover connector for IdP high availability

> **[Generic OIDC](/reference/orchestrator/identity-fabric/custom-oidc)**
>
> Generic OpenID Connect connector

> **[Generic SAML](/reference/orchestrator/identity-fabric/custom-saml)**
>
> Generic SAML 2.0 connector

> **[CyberArk (OIDC)](/reference/orchestrator/identity-fabric/cyberark)**
>
> CyberArk Identity OIDC SSO

> **[CyberArk (SAML)](/reference/orchestrator/identity-fabric/cyberark-saml)**
>
> CyberArk Identity SAML federation

> **[Duo (SAML)](/reference/orchestrator/identity-fabric/duo)**
>
> Duo Security MFA federation

> **[Google Workspace (OIDC)](/reference/orchestrator/identity-fabric/google-workspace)**
>
> Google Workspace SSO using generic OIDC

> **[HYPR](/reference/orchestrator/identity-fabric/hypr)**
>
> HYPR passwordless authentication

> **[Keycloak (OIDC)](/reference/orchestrator/identity-fabric/keycloak)**
>
> Keycloak SSO federation

> **[LDAP Authentication](/reference/orchestrator/identity-fabric/ldap)**
>
> LDAP bind authentication for end users

> **[LDAP Attribute Provider](/reference/orchestrator/identity-fabric/ldap-attr)**
>
> LDAP attribute lookups for enrichment

> **[Microsoft Active Directory](/reference/orchestrator/identity-fabric/activedirectory)**
>
> Active Directory connector via LDAP

> **[Microsoft ADFS (SAML)](/reference/orchestrator/identity-fabric/adfs)**
>
> ADFS federation via SAML

> **[Microsoft Entra ID (OIDC)](/reference/orchestrator/identity-fabric/azure-ad)**
>
> OIDC connector for Microsoft Entra ID

> **[Microsoft Entra ID (SAML)](/reference/orchestrator/identity-fabric/entra-id-saml)**
>
> SAML connector for Microsoft Entra ID

> **[Microsoft Entra ID Attribute Provider](/reference/orchestrator/identity-fabric/entra-id-attr)**
>
> Entra ID attribute enrichment via Microsoft Graph

> **[Microsoft Windows Client Authenticator](/reference/orchestrator/identity-fabric/wca)**
>
> Windows desktop credential authentication via IIS

> **[Okta (OIDC)](/reference/orchestrator/identity-fabric/okta)**
>
> OIDC connector for Okta

> **[Okta (SAML)](/reference/orchestrator/identity-fabric/okta-saml)**
>
> SAML connector for Okta

> **[Okta Attribute Provider](/reference/orchestrator/identity-fabric/okta-attr)**
>
> Okta attribute enrichment via API

> **[Oracle Identity Cloud Service (OIDC)](/reference/orchestrator/identity-fabric/oracle-ics)**
>
> Oracle IDCS SSO

> **[Oracle Universal Directory (LDAP)](/reference/orchestrator/identity-fabric/oracle-oud)**
>
> Oracle OUD directory integration

> **[PingFederate (OIDC)](/reference/orchestrator/identity-fabric/pingone)**
>
> OIDC connector for PingFederate

> **[PingFederate (SAML)](/reference/orchestrator/identity-fabric/pingfederate-saml)**
>
> SAML connector for PingFederate

> **[Trusona (OIDC)](/reference/orchestrator/identity-fabric/trusona)**
>
> Trusona identity verification

> **[WSO2 Identity Server (OIDC)](/reference/orchestrator/identity-fabric/wso2)**
>
> WSO2 Identity Server SSO

## Related Pages

> **[Config Sources](/reference/orchestrator/configuration/config-sources)**
>
> Where the Orchestrator reads its configuration

> **[Secret Providers](/reference/orchestrator/configuration/secret-providers)**
>
> How the Orchestrator retrieves secrets at runtime

> **[Sessions](/reference/orchestrator/sessions)**
>
> Session storage options and production support status