An Identity Fabric is an architectural approach that connects disparate identity systems (Active Directory, LDAP, Entra ID, Okta, database-backed legacy apps) through a unified control plane. Instead of migrating every application to a single identity provider, the fabric provides seamless single sign-on, adaptive MFA, and consistent policy enforcement across all environments — on-premises, cloud, SaaS, and legacy.
Why Organizations Have Identity Sprawl
Identity systems accumulate over decades. The mainframe uses RACF. Legacy ERP uses database authentication. On-prem apps use Active Directory. Cloud SaaS uses Entra ID or Okta. Custom apps use local user tables. Each system has its own credentials, policies, and audit logs. Managing access across 15 identity systems creates administrative overhead, security gaps, and poor user experience.
The Identity Fabric Concept
An Identity Fabric does not replace existing identity systems — it connects them. Think of it as an identity integration layer that provides a unified API for authentication, authorization, and user management across all connected systems. Applications continue using their native identity backend, but the fabric enables cross-system single sign-on, consistent MFA, and centralized policy enforcement.
Key Challenges
Legacy Application Constraints
Mainframe applications, custom database apps, and embedded systems often cannot support modern authentication protocols (SAML, OIDC, OAuth). They use proprietary authentication mechanisms, custom login screens, and database-stored credentials. Connecting these to a unified fabric requires protocol translation or reverse-proxy authentication.
Policy Consistency
Different identity systems enforce different password policies, MFA requirements, and session timeouts. A unified fabric must reconcile these differences — applying the strictest policy across all systems without breaking legacy applications that cannot support modern policy features.
Audit and Compliance
Regulatory requirements (SOX, HIPAA, PCI DSS, ISO 27001) demand centralized access auditing. When identity is distributed across 15 systems, generating a unified access report is nearly impossible. The fabric must aggregate audit logs from all connected systems into a single view.
Recommended Implementation Framework
1. Identity Discovery and Mapping
Catalog all identity stores: Active Directory domains, LDAP directories, SaaS identity providers, database user tables, application-local accounts, and service accounts. Map trust relationships between systems. Identify authentication protocols supported by each application. This inventory drives the integration approach.
2. Federation Layer Deployment
Deploy an identity broker (Keycloak, Azure AD B2C, or commercial identity fabric platforms) that supports multiple federation protocols: SAML 2.0 for legacy web apps, OIDC for modern apps, LDAP for directory-backed apps, and SCIM for user provisioning. The broker translates between protocols.
3. Seamless Single Sign-On
Configure SSO so users authenticate once against their primary identity source (typically Active Directory or Entra ID) and gain access to all connected applications without re-authentication. For legacy apps that cannot support SAML/OIDC, deploy reverse-proxy authentication (Azure AD Application Proxy, PingAccess) that intercepts authentication and translates to the app's native protocol.
4. Adaptive MFA Across All Systems
Layer adaptive MFA on top of the federation layer. MFA decisions are made centrally based on risk signals (device compliance, location, time, behavior) and enforced across all connected applications — including legacy apps that cannot implement MFA natively. The fabric handles MFA challenge/response before passing authentication to the backend.
5. Centralized Audit and Compliance
Aggregate authentication and authorization logs from all connected systems into a centralized audit store. Generate compliance reports showing who accessed what, when, from where, and with what authentication method — across all identity systems, in a single view.
| Aspect | Identity Silos | Identity Fabric |
|---|---|---|
| User Experience | Multiple logins, password fatigue | Single sign-on everywhere |
| MFA Enforcement | Inconsistent across systems | Centralized, adaptive MFA |
| Policy Consistency | Different per system | Unified policy engine |
| Audit Trail | Fragmented across systems | Centralized, unified view |
| Provisioning | Manual per system | Automated via SCIM |
| Legacy App Support | Often excluded | Protocol translation included |
Identity silos vs. identity fabric approach
Practical Recommendations
- Conduct identity discovery: catalog all identity stores, protocols, and trust relationships across the organization.
- Deploy an identity broker that supports SAML, OIDC, LDAP, and SCIM for maximum protocol coverage.
- Implement seamless SSO using federation and reverse-proxy authentication for legacy applications.
- Layer adaptive MFA centrally — enforce across all applications including legacy systems via the fabric.
- Aggregate audit logs from all connected identity systems into a centralized compliance view.
