Continuity

​

Overview

​

Identity Backup vs Identity Continuity

• Identity Backup preserves identity data (users, groups, policies) so it can be restored after an outage. It protects the data itself.
• Identity Continuity ensures that authentication and access remain uninterrupted during an IdP outage. It protects the user experience by routing requests to an alternate identity provider while the primary is down.

​

Use Cases

• Cloud IdP to on-premises failover — When a cloud identity provider (such as Okta or Entra ID) experiences an outage, automatically fail over to an on-premises IdP like ADFS or Active Directory to maintain uninterrupted access.
• Cloud IdP to cloud IdP failover — Maintain high availability by failing over between two cloud identity providers (e.g., Okta primary with Entra ID backup).
• Zero-downtime IdP migration — Gradually shift authentication from one identity provider to another without service interruption. Set the new IdP as primary and the old IdP as fallback during the transition period.
• Gradual cutover between identity providers — Migrate users from a legacy IdP to a modern one while maintaining fallback during the transition.

​

Supported Identity Services

​

Configuration

• Console UI
• Configuration

To create a Continuity Strategy in the Maverics Console:

1. Navigate to Identity Fabric in the Console sidebar.
2. Click Create and select Continuity Strategy.
3. Enter a Name for the strategy — this is the friendly name that identifies your failover configuration.
4. In the Fallback Strategy section, add identity providers in priority order. The first provider is the primary; subsequent providers serve as backups that are used when providers above them are unavailable.
5. In the Schema Abstraction Layer section, define attribute mappings. For each attribute your applications need, map it to the corresponding claim name in each identity provider (see Schema Abstraction Layer below).
6. Click Save.

Deploying a Continuity Strategy to production requires a license. Contact [email protected] for licensing.

maverics.yaml

Copy

connectors:
  - name: failover-idp
    type: continuity
    strategy: failover
    failover:
      idps:
        - primary-idp
        - backup-idp
    attributes:
      - name: email
        mapping:
          primary-idp: primary_email
          backup-idp: backup_email
        default: "[email protected]"

​

Configuration Reference

​

How Failover Works

1. The Orchestrator performs configurable health checks on each connector listed in failover.idps. Health checks run at the interval specified on each individual connector’s healthCheck configuration.
2. When an authentication request arrives, the Orchestrator routes it to the first healthy connector in the ordered list.
3. If the primary connector’s health check is failing, the Orchestrator skips it and routes to the next healthy connector in the list. This is proactive, health-check-driven routing — not trial-and-error login attempts.
4. The attributes section normalizes attribute names across providers, so downstream applications see consistent attribute names regardless of which IdP handled the authentication.

​

Health Monitoring

​

Health Check Configuration

connectors:
  - name: primary-idp
    type: oidc
    oidcWellKnownURL: "https://primary.example.com/.well-known/openid-configuration"
    oauthClientID: "{{ env.PRIMARY_CLIENT_ID }}"
    oauthClientSecret: <vault.primary_client_secret>
    oauthRedirectURL: "https://app.example.com/oidc/callback"
    scopes: "openid profile email"
    healthCheck:
      enabled: true
      interval: "10s"
      timeout: "5s"
      unhealthyThreshold: 3
      healthyThreshold: 2

​

Health Check Fields

​

Custom Health Check Fields

​

How Health Checks Work by Protocol

• OIDC-based services (Okta, Entra ID, Auth0, Keycloak, Generic OIDC): Health checks call the well-known discovery endpoint (e.g., /.well-known/openid-configuration). If the endpoint is unreachable or returns an error, the connector is marked unhealthy.
• SAML-based services (ADFS SAML, Generic SAML, Ping Federate): Health checks call the IdP’s metadata endpoint.
• LDAP/AD services (Active Directory, LDAP): Health checks attempt a connection to the server URL and perform a bind operation.

level=debug msg="idp health check failed: well-known metadata unavailable"

​

Schema Abstraction Layer

connectors:
  - name: failover-idp
    type: continuity
    strategy: failover
    failover:
      idps:
        - okta-idp
        - entra-idp
        - ldap-idp
    attributes:
      - name: email
        mapping:
          okta-idp: email
          entra-idp: preferred_username
          ldap-idp: mail
      - name: role
        mapping:
          okta-idp: role
          entra-idp: group
        default: "user"
      - name: display_name
        mapping:
          okta-idp: name
          entra-idp: displayName
          ldap-idp: cn

• name — The normalized attribute name that your applications will receive.
• mapping — A map from connector name to the claim name used by that provider.
• default — An optional fallback value if the attribute is unavailable from the authenticating IdP.

​

Troubleshooting

​

Related Pages