domains / families / security / identity-provider-recon

identity-provider-recon

separate

Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provenance edge held out of attack-path pivoting), Okta org-slug derivation + OIDC fingerprint + governed custom-domain enumeration, ADFS passive/active fingerprint + version inference, Google Workspace MX-correlated detection, generic OIDC (Auth0/Keycloak/Ping Identity/OneLogin/Duo) discovery, SAML metadata (5 paths), Azure AD Seamless-SSO Negotiate-challenge detection, Microsoft Defender for Identity (MDI) sensor-API presence check, the user-enumeration oracle methodology for Microsoft GetCredential…

When to use

• domain-to-tenant resolution
• tenant/federation fingerprinting
• pre-auth user-enumeration oracle
• Okta org-slug derivation
• ADFS passive/active fingerprint
• Google Workspace MX-correlated detection
• generic OIDC discovery
• login-candidate synthesis

When not to use

• password spray
• credential submission
• auth bypass
• replay breach creds
• forge/replay a token
• confirm an auth-bypass

Skill page

Source