> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity Fabric

Every organization has an identity fabric -- it's the collection of identity providers, directories, and authentication systems that together determine who can access what. For most enterprises, this fabric is not a single system. It's Entra ID for cloud apps, Active Directory for on-prem resources, an LDAP directory for legacy systems, maybe Okta or PingFederate from an acquisition. Different protocols, different vendors, different eras of technology -- all serving the same fundamental purpose.

The Maverics Orchestrator connects to your identity fabric through **connectors**. Each connector integrates with one identity provider or attribute source, abstracting the protocol details (OIDC, SAML, LDAP) behind a uniform interface. This means the Orchestrator can authenticate users against any provider, pull attributes from any directory, and translate between protocols -- without your applications knowing or caring which systems are involved upstream.

<Note>
  **Console terminology:** In the Maverics Console, this section is called
  **Identity Fabric**. The YAML configuration uses the `connectors` key to define
  identity provider integrations.
</Note>

## Available Connectors

The Orchestrator ships with connectors for the identity providers and directories enterprises use most.

| Connector                                                                                      | Protocol             | Use Case                                          |
| ---------------------------------------------------------------------------------------------- | -------------------- | ------------------------------------------------- |
| [1Kosmos (SAML)](/reference/orchestrator/identity-fabric/onekosmos)                            | SAML                 | 1Kosmos passwordless MFA                          |
| [Amazon Cognito (OIDC)](/reference/orchestrator/identity-fabric/cognito)                       | OIDC                 | Cognito user pool SSO, AWS identity               |
| [Auth0 (OIDC)](/reference/orchestrator/identity-fabric/auth0)                                  | OIDC                 | Auth0 SSO federation, tenant migration            |
| [Continuity](/reference/orchestrator/identity-fabric/continuity)                               | Failover aggregation | IdP failover, zero-downtime migration             |
| [Generic OIDC](/reference/orchestrator/identity-fabric/custom-oidc)                            | OIDC                 | Any OIDC-compliant provider                       |
| [Generic SAML](/reference/orchestrator/identity-fabric/custom-saml)                            | SAML 2.0             | Any SAML-compliant provider                       |
| [CyberArk (OIDC)](/reference/orchestrator/identity-fabric/cyberark)                            | OIDC                 | CyberArk Identity SSO                             |
| [CyberArk (SAML)](/reference/orchestrator/identity-fabric/cyberark-saml)                       | SAML 2.0             | CyberArk Identity SAML federation                 |
| [Duo (SAML)](/reference/orchestrator/identity-fabric/duo)                                      | SAML 2.0             | Duo Security MFA federation                       |
| [Google Workspace (OIDC)](/reference/orchestrator/identity-fabric/google-workspace)            | OIDC                 | Google Workspace SSO (uses generic OIDC)          |
| [HYPR](/reference/orchestrator/identity-fabric/hypr)                                           | HYPR                 | HYPR passwordless authentication                  |
| [Keycloak (OIDC)](/reference/orchestrator/identity-fabric/keycloak)                            | OIDC                 | Keycloak SSO federation                           |
| [LDAP Authentication](/reference/orchestrator/identity-fabric/ldap)                            | LDAP/LDAPS           | LDAP bind authentication for end users            |
| [LDAP Attribute Provider](/reference/orchestrator/identity-fabric/ldap-attr)                   | LDAP/LDAPS           | LDAP attribute lookups for enrichment             |
| [Microsoft Active Directory](/reference/orchestrator/identity-fabric/activedirectory)          | LDAP (via AD)        | Active Directory integration                      |
| [Microsoft ADFS (SAML)](/reference/orchestrator/identity-fabric/adfs)                          | SAML 2.0             | ADFS-to-cloud migration, hybrid federation        |
| [Microsoft Entra ID (OIDC)](/reference/orchestrator/identity-fabric/azure-ad)                  | OIDC                 | Entra ID SSO, hybrid identity                     |
| [Microsoft Entra ID (SAML)](/reference/orchestrator/identity-fabric/entra-id-saml)             | SAML 2.0             | Entra ID SAML-based federation                    |
| [Microsoft Entra ID Attribute Provider](/reference/orchestrator/identity-fabric/entra-id-attr) | Graph API            | Entra ID attribute enrichment via Microsoft Graph |
| [Microsoft Windows Client Authenticator](/reference/orchestrator/identity-fabric/wca)          | Windows auth         | Windows desktop credential authentication via IIS |
| [Okta (OIDC)](/reference/orchestrator/identity-fabric/okta)                                    | OIDC                 | Okta SSO consolidation, legacy app bridging       |
| [Okta (SAML)](/reference/orchestrator/identity-fabric/okta-saml)                               | SAML 2.0             | Okta SAML-based federation                        |
| [Okta Attribute Provider](/reference/orchestrator/identity-fabric/okta-attr)                   | Okta API             | Okta attribute enrichment via API                 |
| [Oracle Identity Cloud Service (OIDC)](/reference/orchestrator/identity-fabric/oracle-ics)     | OIDC                 | Oracle IDCS SSO                                   |
| [Oracle Universal Directory (LDAP)](/reference/orchestrator/identity-fabric/oracle-oud)        | LDAP/LDAPS           | Oracle OUD directory integration                  |
| [PingFederate (OIDC)](/reference/orchestrator/identity-fabric/pingone)                         | OIDC                 | PingFederate on-premises federation               |
| [PingFederate (SAML)](/reference/orchestrator/identity-fabric/pingfederate-saml)               | SAML 2.0             | PingFederate SAML-based federation                |
| [Trusona (OIDC)](/reference/orchestrator/identity-fabric/trusona)                              | OIDC                 | Trusona identity verification                     |
| [WSO2 Identity Server (OIDC)](/reference/orchestrator/identity-fabric/wso2)                    | OIDC                 | WSO2 Identity Server SSO                          |

## Mode Compatibility

Identity Fabric connectors work with all five Orchestrator modes. The connector determines which protocol the Orchestrator uses to communicate with your **identity provider**. The mode determines which protocol the Orchestrator uses to communicate with your **application**. These are independent -- an OIDC connector can feed a SAML Provider mode app, and a SAML connector can feed an OIDC Provider mode app. The Orchestrator handles all protocol translation.

* **OIDC connectors** (Microsoft Entra ID, Okta, Auth0, PingFederate, Amazon Cognito, Generic OIDC) -- Used with all modes. Most common for OIDC Provider and HTTP Proxy.
* **SAML connectors** (Generic SAML, Microsoft ADFS, Entra ID SAML, Okta SAML, PingFederate SAML, CyberArk SAML, Duo) -- Used primarily with SAML Provider and HTTP Proxy. The Orchestrator translates SAML upstream to any downstream protocol.
* **LDAP connectors** (LDAP, Microsoft Active Directory, Oracle Universal Directory) -- Used primarily as attribute providers (enriching claims with directory data). Most common with HTTP Proxy and LDAP Provider modes.
* **Continuity connector** -- Mode-agnostic. Wraps other connectors to provide IdP failover.

See the [connector compatibility matrix](/guides/authentication/choosing-a-mode#connector-compatibility) for the full matrix showing which connectors are commonly paired with which modes.

## Setup

<Tabs>
  <Tab title="Console UI">
    To create an Identity Fabric connector in the Maverics Console:

    1. Navigate to **Identity Fabric** in the Console sidebar.
    2. Click **Create** to open the connector type selection dialog.
    3. Select the connector type that matches your identity provider (e.g., **Microsoft Entra ID (OIDC)**, **Okta (OIDC)**, **Generic SAML**).
    4. Fill in the required fields for your selected connector type -- see the individual connector pages for field-by-field instructions.
    5. Click **Save**.

    <Tip>
      Each connector type has its own configuration form. See the individual connector pages linked below for detailed Console UI walkthroughs specific to each provider.
    </Tip>
  </Tab>

  <Tab title="Configuration">
    ```yaml maverics.yaml theme={null}
    connectors:
      - name: azure
        type: azure
        oauthClientID: "{{ env.AZURE_CLIENT_ID }}"
        oauthClientSecret: <vault.azure_client_secret>
        oidcWellKnownURL: "https://login.microsoftonline.com/{{ env.AZURE_TENANT_ID }}/v2.0/.well-known/openid-configuration"
        oauthRedirectURL: "https://app.example.com/callback"
        scopes: "openid profile email"
        tls: "idp-tls"
        healthCheck:
          enabled: true
          interval: "30s"
          timeout: "5s"
          healthyThreshold: 3
          unhealthyThreshold: 3

      - name: corporate-ldap
        type: ldap
        url:
          - "ldaps://ldap.example.com:636"
        serviceAccountUsername: "cn=maverics,ou=services,dc=example,dc=com"
        serviceAccountPassword: <vault.ldap_password>
        baseDN: "dc=example,dc=com"
        usernameSearchKey: "uid"
        userAttributes:
          - "cn"
          - "mail"
          - "memberOf"
        attributeMapping:
          email: "mail"
          name: "cn"
        tls: "ldap-tls"
    ```
  </Tab>
</Tabs>

## Connector Pages

<CardGroup cols={2}>
  <Card title="1Kosmos (SAML)" icon="id-card" href="/reference/orchestrator/identity-fabric/onekosmos">
    1Kosmos passwordless MFA
  </Card>

  <Card title="Amazon Cognito (OIDC)" icon="aws" href="/reference/orchestrator/identity-fabric/cognito">
    OIDC connector for AWS Cognito user pools
  </Card>

  <Card title="Auth0 (OIDC)" icon="openid" href="/reference/orchestrator/identity-fabric/auth0">
    OIDC connector for Auth0 by Okta
  </Card>

  <Card title="Continuity" icon="arrows-rotate" href="/reference/orchestrator/identity-fabric/continuity">
    Failover connector for IdP high availability
  </Card>

  <Card title="Generic OIDC" icon="openid" href="/reference/orchestrator/identity-fabric/custom-oidc">
    Generic OpenID Connect connector
  </Card>

  <Card title="Generic SAML" icon="file-shield" href="/reference/orchestrator/identity-fabric/custom-saml">
    Generic SAML 2.0 connector
  </Card>

  <Card title="CyberArk (OIDC)" icon="vault" href="/reference/orchestrator/identity-fabric/cyberark">
    CyberArk Identity OIDC SSO
  </Card>

  <Card title="CyberArk (SAML)" icon="vault" href="/reference/orchestrator/identity-fabric/cyberark-saml">
    CyberArk Identity SAML federation
  </Card>

  <Card title="Duo (SAML)" icon="shield-halved" href="/reference/orchestrator/identity-fabric/duo">
    Duo Security MFA federation
  </Card>

  <Card title="Google Workspace (OIDC)" icon="google" href="/reference/orchestrator/identity-fabric/google-workspace">
    Google Workspace SSO using generic OIDC
  </Card>

  <Card title="HYPR" icon="fingerprint" href="/reference/orchestrator/identity-fabric/hypr">
    HYPR passwordless authentication
  </Card>

  <Card title="Keycloak (OIDC)" icon="lock-open" href="/reference/orchestrator/identity-fabric/keycloak">
    Keycloak SSO federation
  </Card>

  <Card title="LDAP Authentication" icon="folder-tree" href="/reference/orchestrator/identity-fabric/ldap">
    LDAP bind authentication for end users
  </Card>

  <Card title="LDAP Attribute Provider" icon="folder-tree" href="/reference/orchestrator/identity-fabric/ldap-attr">
    LDAP attribute lookups for enrichment
  </Card>

  <Card title="Microsoft Active Directory" icon="microsoft" href="/reference/orchestrator/identity-fabric/activedirectory">
    Active Directory connector via LDAP
  </Card>

  <Card title="Microsoft ADFS (SAML)" icon="microsoft" href="/reference/orchestrator/identity-fabric/adfs">
    ADFS federation via SAML
  </Card>

  <Card title="Microsoft Entra ID (OIDC)" icon="microsoft" href="/reference/orchestrator/identity-fabric/azure-ad">
    OIDC connector for Microsoft Entra ID
  </Card>

  <Card title="Microsoft Entra ID (SAML)" icon="microsoft" href="/reference/orchestrator/identity-fabric/entra-id-saml">
    SAML connector for Microsoft Entra ID
  </Card>

  <Card title="Microsoft Entra ID Attribute Provider" icon="microsoft" href="/reference/orchestrator/identity-fabric/entra-id-attr">
    Entra ID attribute enrichment via Microsoft Graph
  </Card>

  <Card title="Microsoft Windows Client Authenticator" icon="windows" href="/reference/orchestrator/identity-fabric/wca">
    Windows desktop credential authentication via IIS
  </Card>

  <Card title="Okta (OIDC)" icon="shield-halved" href="/reference/orchestrator/identity-fabric/okta">
    OIDC connector for Okta
  </Card>

  <Card title="Okta (SAML)" icon="shield-halved" href="/reference/orchestrator/identity-fabric/okta-saml">
    SAML connector for Okta
  </Card>

  <Card title="Okta Attribute Provider" icon="shield-halved" href="/reference/orchestrator/identity-fabric/okta-attr">
    Okta attribute enrichment via API
  </Card>

  <Card title="Oracle Identity Cloud Service (OIDC)" icon="database" href="/reference/orchestrator/identity-fabric/oracle-ics">
    Oracle IDCS SSO
  </Card>

  <Card title="Oracle Universal Directory (LDAP)" icon="database" href="/reference/orchestrator/identity-fabric/oracle-oud">
    Oracle OUD directory integration
  </Card>

  <Card title="PingFederate (OIDC)" icon="circle-dot" href="/reference/orchestrator/identity-fabric/pingone">
    OIDC connector for PingFederate
  </Card>

  <Card title="PingFederate (SAML)" icon="circle-dot" href="/reference/orchestrator/identity-fabric/pingfederate-saml">
    SAML connector for PingFederate
  </Card>

  <Card title="Trusona (OIDC)" icon="user-check" href="/reference/orchestrator/identity-fabric/trusona">
    Trusona identity verification
  </Card>

  <Card title="WSO2 Identity Server (OIDC)" icon="globe" href="/reference/orchestrator/identity-fabric/wso2">
    WSO2 Identity Server SSO
  </Card>
</CardGroup>

## Related Pages

<CardGroup cols={2}>
  <Card title="Config Sources" icon="gear" href="/reference/orchestrator/configuration/config-sources">
    Where the Orchestrator reads its configuration
  </Card>

  <Card title="Secret Providers" icon="vault" href="/reference/orchestrator/configuration/secret-providers">
    How the Orchestrator retrieves secrets at runtime
  </Card>

  <Card title="Sessions" icon="user-clock" href="/reference/orchestrator/sessions">
    Session storage options and production support status
  </Card>
</CardGroup>