Continuity

​

Overview

​

Identity Backup vs Identity Continuity

• Identity Backup preserves identity data (users, groups, policies) so it can be restored after an outage. It protects the data itself.
• Identity Continuity ensures that authentication and access remain uninterrupted during an IdP outage. It protects the user experience by routing requests to an alternate identity provider while the primary is down.

​

Use Cases

• Identity resilience with automatic failover — Ensure authentication never goes down by automatically routing users to a healthy backup IdP when the primary experiences an outage. Health-check-driven failover eliminates manual intervention and keeps business-critical applications accessible.
• Cloud-to-on-premises failover — When a cloud IdP (such as Okta or Entra ID) is unavailable, automatically fail over to an on-premises IdP like ADFS or Active Directory so users maintain uninterrupted access to applications.
• Cloud-to-cloud redundancy — Maintain high availability by configuring failover between two cloud identity providers (e.g., Okta primary with Entra ID backup), protecting against vendor-specific outages.
• Zero-downtime IdP migration — Gradually shift authentication from a legacy IdP to a modern one without service interruption. Set the new IdP as primary and keep the old IdP as fallback during the transition, reducing risk and enabling IdP rationalization.

​

Supported Identity Services

​

Setup

• Console UI
• Configuration

To create a Continuity Strategy in the Maverics Console:

1. Navigate to Identity Fabric in the Console sidebar.
2. Click Create and select Continuity Strategy.
3. Enter a Name for the strategy — this is the friendly name that identifies your failover configuration.
4. In the Fallback Strategy section, add identity providers in priority order. The first provider is the primary; subsequent providers serve as backups that are used when providers above them are unavailable.
5. In the Schema Abstraction Layer section, define attribute mappings. For each attribute your applications need, map it to the corresponding claim name in each identity provider (see Schema Abstraction Layer below).
6. Click Save.

Deploying a Continuity Strategy to production requires a license. Contact sales@strata.io for licensing.

maverics.yaml

connectors:
  - name: failover-idp
    type: continuity
    strategy: failover
    failover:
      idps:
        - primary-idp
        - backup-idp
    attributes:
      - name: email
        mapping:
          primary-idp: primary_email
          backup-idp: backup_email
        default: "unknown@example.com"

​

Configuration Reference

Key	Type	Required	Description
name	string	Yes	Unique connector identifier referenced by app policies
type	string	Yes	Must be continuity
strategy	string	Yes	Failover strategy — currently only failover is supported
failover.idps	string[]	Yes	Ordered list of connector names to try. The first entry is the primary; subsequent entries are fallbacks tried in order.
attributes	object[]	No	Attribute normalization rules across identity providers
attributes[].name	string	Yes	Normalized attribute name used by the Orchestrator
attributes[].mapping	map	Yes	Map of connector name to that connector’s attribute name (e.g., primary-idp: "primary_email")
attributes[].default	string	No	Default value if the attribute is unavailable from any IdP

For the complete connector field reference, see Identity Fabric.

The connectors listed in failover.idps must be separately defined in the connectors section. The Continuity connector does not create them — it orchestrates failover between existing connectors. Each referenced connector (e.g., an OIDC or SAML connector) must have its own complete configuration.

​

How Failover Works

1. The Orchestrator performs configurable health checks on each connector listed in failover.idps. Health checks run at the interval specified on each individual connector’s healthCheck configuration.
2. When an authentication request arrives, the Orchestrator routes it to the first healthy connector in the ordered list.
3. If the primary connector’s health check is failing, the Orchestrator skips it and routes to the next healthy connector in the list. This is proactive, health-check-driven routing — not trial-and-error login attempts.
4. The attributes section normalizes attribute names across providers, so downstream applications see consistent attribute names regardless of which IdP handled the authentication.

​

Health Monitoring

​

Health Check Configuration

connectors:
  - name: primary-idp
    type: oidc
    oidcWellKnownURL: "https://primary.example.com/.well-known/openid-configuration"
    oauthClientID: "{{ env.PRIMARY_CLIENT_ID }}"
    oauthClientSecret: <vault.primary_client_secret>
    oauthRedirectURL: "https://app.example.com/oidc/callback"
    scopes: "openid profile email"
    healthCheck:
      enabled: true
      interval: "10s"
      timeout: "5s"
      unhealthyThreshold: 3
      healthyThreshold: 2

​

Health Check Fields

​

Custom Health Check Fields

​

How Health Checks Work by Protocol

• OIDC-based services (Okta, Entra ID, Auth0, Keycloak, Generic OIDC): Health checks call the well-known discovery endpoint (e.g., /.well-known/openid-configuration). If the endpoint is unreachable or returns an error, the connector is marked unhealthy.
• SAML-based services (ADFS SAML, Generic SAML, Ping Federate): Health checks call the IdP’s metadata endpoint.
• LDAP/AD services (Active Directory, LDAP): Health checks attempt a connection to the server URL and perform a bind operation.

level=debug msg="idp health check failed: well-known metadata unavailable"

​

Schema Abstraction Layer

connectors:
  - name: failover-idp
    type: continuity
    strategy: failover
    failover:
      idps:
        - okta-idp
        - entra-idp
        - ldap-idp
    attributes:
      - name: email
        mapping:
          okta-idp: email
          entra-idp: preferred_username
          ldap-idp: mail
      - name: role
        mapping:
          okta-idp: role
          entra-idp: group
        default: "user"
      - name: display_name
        mapping:
          okta-idp: name
          entra-idp: displayName
          ldap-idp: cn

• name — The normalized attribute name that your applications will receive.
• mapping — A map from connector name to the claim name used by that provider.
• default — An optional fallback value if the attribute is unavailable from the authenticating IdP.

​

Troubleshooting

​

Related Pages