# Identity Provider Recon

Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the...

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: DevOps
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill identity-provider-recon -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill identity-provider-recon -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill identity-provider-recon -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill identity-provider-recon -g -a gemini-cli -y`

## Description

Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology, enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provenance edge held out of attack-path pivoting), Okta org-slug derivation + OIDC fingerprint + governed custom-domain enumeration, ADFS passive/active fingerprint + version inference, Google Workspace MX-correlated detection, generic OIDC (Auth0/Keycloak/Ping Identity/OneLogin/Duo) discovery, SAML metadata (5 paths), Azure AD Seamless-SSO Negotiate-challenge detection, Microsoft Defender for Identity (MDI) sensor-API presence check, the user-enumeration oracle methodology for Microsoft GetCredentialType (IfExistsResult semantics: exists / doesn't-exist / exists-in-federated-tenant / throttled) and Okta /api/v1/authn (errorCode differential), Medium-detectability discipline with a hard 20-candidate-per-tenant cap and admin/role interest-based ranking, and name x confirmed-email-pattern login-candidate synthesis that FAILS CLOSED with zero output when no org pattern is confirmed. Grounded directly in a production ASM implementation's sso_idp.py, tenant_recon.py, and core/email_patterns.py mod

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Identity-Provider Recon, Tenant, Federation & User-Enumeration Oracle Mapping

> Companion skills: [`osint-methodology`](../osint-methodology/) (§6.2 detectability tagging, §11
> identity-fabric pointer, the "how to think" skill this plugs into) and
> [`offensive-osint`](../offensive-osint/) (§22 Identity Fabric, the concrete endpoint/payload
> reference this skill builds a workflow on top of, rather than re-listing). This skill answers the
> question those two don't: **how do the tenant, its federation partners, its IdP, and its
> user-enumeration oracle fit together as one map**, and where exactly enumeration stops and
> credential submission begins.

## 0. When to Use / When NOT

**Use this skill when:**

- You need to resolve a domain to its identity tenant (Entra/Okta/ADFS/Google Workspace) and
  determine whether auth is Managed or Federated.
- You need to map an org's **federation boundary**, every sibling domain that shares the same
  M365/Azure AD tenant trust, not just the seed.
- You need to distinguish Entra vs. Okta vs. ADFS vs. Google Workspace vs. a generic OIDC IdP from
  passive/low-detectability signals.
- You need to detect Seamless SSO or Microsoft Defender for Identity (MDI) presence, both change
  the risk calculus of anything downstream.
- You have **authorization for a Medium-detectability, log-generating pass** and need to run a
  pre-auth user-enumeration oracle (GetCredentialType / Okta `/api/v1/authn`) to build a valid-account
  list, **without ever submitting a password**.
- You have harvested employee names and a **confirmed** org email-format pattern and need to
  synthesize ranked login candidates to feed that oracle.

**Do NOT use this skill when:**

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/identity-provider-recon/SKILL.md