Identity Provider Recon
Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the...
Install
npx skills add elementalsouls/Claude-OSINT --skill identity-provider-recon -g -a claude-code -y- Repository
- elementalsouls/Claude-OSINT2.9k
- Category
- DevOps
- Updated
- 15d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology, enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provenance edge held out of attack-path pivoting), Okta org-slug derivation + OIDC fingerprint + governed custom-domain enumeration, ADFS passive/active fingerprint + version inference, Google Workspace MX-correlated detection, generic OIDC (Auth0/Keycloak/Ping Identity/OneLogin/Duo) discovery, SAML metadata (5 paths), Azure AD Seamless-SSO Negotiate-challenge detection, Microsoft Defender for Identity (MDI) sensor-API presence check, the user-enumeration oracle methodology for Microsoft GetCredentialType (IfExistsResult semantics: exists / doesn't-exist / exists-in-federated-tenant / throttled) and Okta /api/v1/authn (errorCode differential), Medium-detectability discipline with a hard 20-candidate-per-tenant cap and admin/role interest-based ranking, and name x confirmed-email-pattern login-candidate synthesis that FAILS CLOSED with zero output when no org pattern is confirmed. Grounded directly in a production ASM implementation's sso_idp.py, tenant_recon.py, and core/email_patterns.py mod
Identity-Provider Recon, Tenant, Federation & User-Enumeration Oracle Mapping
Companion skills:
osint-methodology(§6.2 detectability tagging, §11 identity-fabric pointer, the "how to think" skill this plugs into) andoffensive-osint(§22 Identity Fabric, the concrete endpoint/payload reference this skill builds a workflow on top of, rather than re-listing). This skill answers the question those two don't: how do the tenant, its federation partners, its IdP, and its user-enumeration oracle fit together as one map, and where exactly enumeration stops and credential submission begins.
0. When to Use / When NOT
Use this skill when:
- You need to resolve a domain to its identity tenant (Entra/Okta/ADFS/Google Workspace) and determine whether auth is Managed or Federated.
- You need to map an org's federation boundary, every sibling domain that shares the same M365/Azure AD tenant trust, not just the seed.
- You need to distinguish Entra vs. Okta vs. ADFS vs. Google Workspace vs. a generic OIDC IdP from passive/low-detectability signals.
- You need to detect Seamless SSO or Microsoft Defender for Identity (MDI) presence, both change the risk calculus of anything downstream.
- You have authorization for a Medium-detectability, log-generating pass and need to run a
pre-auth user-enumeration oracle (GetCredentialType / Okta
/api/v1/authn) to build a valid-account list, without ever submitting a password. - You have harvested employee names and a confirmed org email-format pattern and need to synthesize ranked login candidates to feed that oracle.
Do NOT use this skill when:
