auditing-directory-sync-trust

Auditing directory sync trust: a bulk feed reshapes identity, so validate what it says before you apply it

Directory synchronization keeps an application's users, groups, and privileges in step with an external source, an LDAP directory, an HR system, an identity provider, another directory, by importing that source's records in bulk on a schedule or on events. That makes the sync feed a firehose of identity changes the application applies largely without a human in the loop, so whatever the source says about who is an admin, who belongs to which group, and which account is which becomes internal truth. When the application trusts source attributes it never validates, a group membership, a department, an is-admin-like flag, an email, then whoever can influence those attributes at the source sets internal privilege. When the sync connector authenticates with a broad or long-lived credential, that credential can read and reshape the entire directory. When an external group name is allowed to map onto a privileged internal group, an attacker who controls a source group name escalates. When accounts are created or matched by a spoofable key like email or external id, an attacker record merges into an existing identity. And when a deletion or suspension in the source does not propagate, departed users linger with access. The audit treats the feed as untrusted input, checks that every attribute that sets privilege or identity is validated, and confirms the connector is scoped and deletions propagate. You audit this by feeding shaped source records and watching what internal state they create.

When to use

• An external directory feed (LDAP, HR system, identity provider, or cross-directory sync) drives internal account, group, and privilege state in bulk.
• The sync may trust source attributes (group, department, admin flag, email) to set privilege or tenancy without validation, or map an external group onto a privileged internal one.
• Accounts may be matched by a spoofable key, the connector credential may be broad, or source deletions may not propagate.