Identity Fabric

Identity connectors allow the Maverics Orchestrator to integrate with upstream identity providers, attribute sources, and authentication services. Each connector abstracts the protocol-specific details, giving you a unified interface for authentication flows and attribute retrieval.

Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define identity provider integrations.

Available Connectors

The following table lists all connector types supported by the Orchestrator. The type column shows the exact value used in the YAML connectors[].type field.

Connector	Type	Protocol	Use Case
Azure AD	`azure`	OIDC	Microsoft Entra ID SSO, hybrid identity
Okta	`okta`	OIDC	Okta SSO consolidation, legacy app bridging
PingFederate	`pingfederate`	OIDC	PingFederate on-premises federation
Auth0	`auth0`	OIDC	Auth0 SSO federation, tenant migration
ADFS	`adfs`	OIDC	ADFS-to-cloud migration, hybrid federation
Amazon Cognito	`cognito`	OIDC	Cognito user pool SSO, AWS identity
Custom OIDC	`oidc`	OIDC	Any OIDC-compliant provider
Google Workspace	`oidc`	OIDC	Google Workspace SSO (uses generic OIDC)
WSO2	`wso2`	OIDC	WSO2 Identity Server
HYPR	`hypr`	OIDC	HYPR passwordless authentication
OneKosmos	`onekosmos`	OIDC	OneKosmos MFA
Custom SAML	`saml`	SAML 2.0	Any SAML-compliant provider
LDAP	`ldap`	LDAP/LDAPS	Legacy directory integration, attribute lookups
Active Directory	`activedirectory`	LDAP (via AD)	Active Directory integration
Continuity	`continuity`	Failover aggregation	IdP failover, zero-downtime migration
Windows Client Authenticator	`windowsclientauthenticator`	Windows auth	Windows desktop credential authentication via IIS

Connector types without dedicated pages (wso2, hypr, onekosmos) use the shared OIDC connector field set documented in the Configuration Reference section below.

Mode Compatibility

Identity Fabric connectors work with all five Orchestrator modes. The connector determines which protocol the Orchestrator uses to communicate with your identity provider. The mode determines which protocol the Orchestrator uses to communicate with your application. These are independent — an OIDC connector can feed a SAML Provider mode app, and a SAML connector can feed an OIDC Provider mode app. The Orchestrator handles all protocol translation.

OIDC connectors (Azure AD, Okta, Auth0, Custom OIDC) — Used with all modes. Most common for OIDC Provider and HTTP Proxy.
SAML connectors (Custom SAML, ADFS) — Used primarily with SAML Provider and HTTP Proxy. The Orchestrator translates SAML upstream to any downstream protocol.
LDAP connectors (LDAP, Active Directory) — Used primarily as attribute providers (enriching claims with directory data). Most common with HTTP Proxy and LDAP Provider modes.
Continuity connector — Mode-agnostic. Wraps other connectors to provide IdP failover.

See the connector compatibility matrix for the full matrix showing which connectors are commonly paired with which modes.

Configuration Reference

Connectors are defined under the connectors top-level key as an array. Each connector has a name (unique identifier) and type (connector protocol). OIDC-based connectors (azure, okta, auth0, adfs, pingfederate, wso2, cognito, and generic oidc) share a common field set. LDAP-based connectors (ldap and activedirectory) have their own field set. The Continuity connector has type-specific fields documented below, with full details on their respective integration reference pages.

Common Fields

Every connector requires a name and type.

Key	Type	Required	Description
`connectors[].name`	string	Yes	Unique connector identifier referenced by app policies and attribute providers
`connectors[].type`	string	Yes	Connector type — see the Available Connectors table above for all supported types

OIDC Connector Fields

These fields apply to connectors with type oidc, azure, okta, auth0, adfs, pingfederate, wso2, or cognito. All OIDC-based connectors share this common field set.

Key	Type	Default	Required	Description
`oauthClientID`	string	—	Yes	OAuth 2.0 client ID issued by the identity provider
`oauthClientSecret`	string	—	Conditional	Client secret — use secret reference syntax `<namespace.key>`; mutually exclusive with `oauthClientAssertion`
`oidcWellKnownURL`	string	—	Yes	OIDC discovery endpoint URL (e.g., `https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration`)
`oauthRedirectURL`	string	—	No	OAuth redirect URL for authentication callback
`oidcLogoutCallbackURL`	string	—	No	OIDC logout callback URL
`scopes`	string	`"openid profile email"`	No	Space-separated OAuth scopes to request during authentication
`disablePKCE`	boolean	`false`	No	Disable Proof Key for Code Exchange (PKCE)
`tls`	string	—	No	TLS profile name for IdP communication — references a named profile under the `tls` top-level key
`oauthClientAssertion.privateKey`	string	—	Conditional	PEM-encoded private key for JWT-based client authentication (RFC 7523); mutually exclusive with `oauthClientSecret`
`oauthClientAssertion.audience`	string	—	No	JWT assertion audience claim

Additional OIDC connector fields (oauthLoginRedirect, oauthLogoutRedirect, offlineAccess) are available for advanced redirect and refresh token configuration. These are documented in detail on individual connector integration reference pages.

SAML Connector Fields

These fields apply to connectors with type saml.

Key	Type	Default	Required	Description
`samlMetadataURL`	string	—	Yes	SAML IdP metadata URL for automatic configuration
`samlConsumerServiceURL`	string	—	Yes	Assertion Consumer Service (ACS) URL where the IdP sends SAML responses
`samlLogoutCallbackURL`	string	—	No	Logout callback URL for SAML single logout
`samlEntityID`	string	—	No	Service Provider entity ID
`samlSPCertPath`	string	—	No	Path to the SP certificate file for request signing
`samlSPKeyPath`	string	—	No	Path to the SP private key file for request signing
`samlNameIDFormat`	string	—	No	Requested Name ID format (e.g., `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`)
`cache`	string	—	No	Cache name reference for SAML request data storage
`tls`	string	—	No	TLS profile name for IdP communication

LDAP Connector Fields

These fields apply to connectors with type ldap or activedirectory.

Key	Type	Default	Required	Description
`url`	array	—	Yes	LDAP server URLs (e.g., `ldap://ldap.example.com:389` or `ldaps://ldap.example.com:636`)
`serviceAccountUsername`	string	—	Yes	Bind DN for the service account (e.g., `cn=admin,dc=example,dc=com`)
`serviceAccountPassword`	string	—	Yes	Service account password — use secret reference syntax `<namespace.key>`
`baseDN`	string	—	Yes	Base DN for LDAP searches (e.g., `dc=example,dc=com`)
`usernameSearchKey`	string	—	No	LDAP attribute used for username lookups (e.g., `uid`, `sAMAccountName`)
`userRDNKey`	string	—	No	Relative Distinguished Name key for user entries
`enableAuthentication`	boolean	—	No	Enable LDAP bind authentication for end users
`loginUrl`	string	—	No	URL for the LDAP login form
`userAttributes`	array	—	No	List of LDAP attributes to retrieve (e.g., `["cn", "email", "memberOf"]`)
`objectClasses`	array	—	No	Object classes for the LDAP search filter (e.g., `["inetOrgPerson"]`)
`attributeMapping`	object	—	No	Map attribute names from LDAP to internal names (e.g., `email: "mail"`, `name: "cn"`)
`attributeDelimiter`	string	`","`	No	Delimiter for multi-valued LDAP attributes
`tls`	string	—	No	TLS profile name for LDAP connection

LDAP connectors use attributeMapping to rename LDAP attributes to friendly names. OIDC connectors do not have an attribute mapping field — OIDC claims are used directly by their claim name. Attribute-to-claim mapping for applications is configured via claimsMapping on OIDC and SAML app types.

Continuity

Continuity connectors provide health-check-driven failover across multiple identity providers. The Orchestrator performs configurable health checks on each configured IdP. If health checks pass, authentication requests are routed to IdPs in the configured order. If an IdP is unhealthy (health check fails), it is skipped and the next healthy IdP handles the authentication request. This is proactive health-check-based routing, not trial-and-error login attempts.

Key	Type	Required	Description
`strategy`	string	Yes	Failover strategy — only `failover` is supported
`failover.idps`	array	Yes	Ordered list of connector names. The first healthy IdP handles requests; unhealthy IdPs are skipped.
`attributes`	array	No	Attribute normalization rules across IDPs

Connector Health Checks

Health check monitoring is available on OIDC, SAML, and LDAP connectors. When enabled, the Orchestrator periodically probes the identity provider and tracks its availability.

Key	Type	Default	Description
`healthCheck.enabled`	boolean	`false`	Enable health monitoring for this connector
`healthCheck.interval`	string	`"30s"`	Time between health check probes (duration string)
`healthCheck.timeout`	string	`"5s"`	Timeout for each health check probe (duration string)
`healthCheck.healthyThreshold`	integer	`3`	Consecutive successes required to mark the connector as healthy
`healthCheck.unhealthyThreshold`	integer	`3`	Consecutive failures required to mark the connector as unhealthy

For advanced scenarios, healthCheck.customEndpoint allows configuring a custom HTTP health probe with specific endpoint URL, headers, TLS profile, and response matching rules (status codes, body content).

Example

Console UI
Configuration

Console UI documentation is coming soon. This section will walk you through configuring this component using the Maverics Console’s visual interface, including step-by-step screenshots and field descriptions.

maverics.yaml

connectors:
  - name: azure
    type: azure
    oauthClientID: "{{ env.AZURE_CLIENT_ID }}"
    oauthClientSecret: <vault.azure_client_secret>
    oidcWellKnownURL: "https://login.microsoftonline.com/{{ env.AZURE_TENANT_ID }}/v2.0/.well-known/openid-configuration"
    oauthRedirectURL: "https://app.example.com/callback"
    scopes: "openid profile email"
    tls: "idp-tls"
    healthCheck:
      enabled: true
      interval: "30s"
      timeout: "5s"
      healthyThreshold: 3
      unhealthyThreshold: 3

  - name: corporate-ldap
    type: ldap
    url:
      - "ldaps://ldap.example.com:636"
    serviceAccountUsername: "cn=maverics,ou=services,dc=example,dc=com"
    serviceAccountPassword: <vault.ldap_password>
    baseDN: "dc=example,dc=com"
    usernameSearchKey: "uid"
    userAttributes:
      - "cn"
      - "mail"
      - "memberOf"
    attributeMapping:
      email: "mail"
      name: "cn"
    tls: "ldap-tls"

Connector Pages

Azure AD

OIDC connector for Microsoft Entra ID

Okta

OIDC connector for Okta platform

PingFederate

OIDC connector for Ping Identity’s PingFederate

Auth0

OIDC connector for Auth0 by Okta

ADFS

OIDC connector for Active Directory Federation Services

Amazon Cognito

OIDC connector for AWS Cognito user pools

Custom OIDC

Generic OpenID Connect connector

Google Workspace

Google Workspace SSO using generic OIDC connector

LDAP

LDAP/LDAPS directory connector

Active Directory

Active Directory connector via LDAP

Custom SAML

Generic SAML 2.0 connector

Continuity

Failover connector for IdP high availability

Windows Client Authenticator

Windows desktop credential authentication via IIS

Config Sources

Where the Orchestrator reads its configuration

Secret Providers

How the Orchestrator retrieves secrets at runtime

Sessions

Session storage options and production support status

Console Administration

Orchestration

Available Connectors

Mode Compatibility

Configuration Reference

Common Fields

OIDC Connector Fields

SAML Connector Fields

LDAP Connector Fields

Continuity

Connector Health Checks

Example

Connector Pages

Azure AD

Okta

PingFederate

Auth0

ADFS

Amazon Cognito

Custom OIDC

Google Workspace

LDAP

Active Directory

Custom SAML

Continuity

Windows Client Authenticator

Config Sources

Secret Providers

Sessions

Console Administration

Orchestration

​Available Connectors

​Mode Compatibility

​Configuration Reference

​Common Fields

​OIDC Connector Fields

​SAML Connector Fields

​LDAP Connector Fields

​Continuity

​Connector Health Checks

​Example

​Connector Pages

Azure AD

Okta

PingFederate

Auth0

ADFS

Amazon Cognito

Custom OIDC

Google Workspace

LDAP

Active Directory

Custom SAML

Continuity

Windows Client Authenticator

​Related Pages

Config Sources

Secret Providers

Sessions

Available Connectors

Mode Compatibility

Configuration Reference

Common Fields

OIDC Connector Fields

SAML Connector Fields

LDAP Connector Fields

Continuity

Connector Health Checks

Example

Connector Pages

Related Pages