IAM Identity Center: permission sync & rollback risk on identity source transition

Vulnerability Overview Vulnerability Type: Data integrity and permission synchronization risks during Identity Source Transition. Core Issue: When switching the identity source of IAM Identity Center from Active Directory to an external IdP (such as Okta), failure to properly execute backup, verification, and synchronization can lead to: - Users, groups, or permission sets being deleted at the moment of the switch (requiring recreation) - Loss of Permission Set Assignments during the switch, necessitating manual recovery - Retention of Application Assignments during the switch, requiring verification of their validity - Inability to roll back if no pre-switch backup was taken, resulting in service interruption or permission mismatches Impact Scope Affected Components: - IAM Identity Center instance - Identity Source (Active Directory / External IdP) - Permission Sets - Application Integrations - Users & Groups Impact Scenarios: - Switching from AD to an external IdP (e.g., Okta) - Switching from an external IdP to AD - Failure to perform backup or verification steps during the transition process - Failure to synchronize permission sets or application assignments after the switch Remediation 1. Pre-switch Backup: - Use scripts to export the current IAM Identity Center configuration (users, groups, permission sets, application assignments) - Backup files should include: , , 2. Verification During Switch: - Confirm the new identity source (e.g., Okta) is correctly configured and that users/groups are synchronized - Verify that Permission Set Assignments are valid under the new identity source - Check that Application Assignments are retained and accessible 3. Post-switch Recovery: - If Permission Set Assignments are lost, they must be manually recreated - If Application Assignments are retained, verify that their functionality is normal - If users/groups are deleted, restore them from the backup 4. Automation Scripts: - Use the script to export the current state - Use the script to restore Permission Set Assignments - Use the script to verify access permissions POC / Exploitation Code Considerations Backup must be completed before the switch; otherwise, rollback is impossible After the switch, the validity of all Permission Sets and Application Assignments must be verified If using Okta as the new identity source, ensure its users/groups are synchronized with IAM Identity Center Avoid modifying Permission Sets or Application Assignments simultaneously during the transition to prevent data inconsistency

Goal Reached Thanks to every supporter — we hit 100%!

IAM Identity Center: permission sync & rollback risk on identity source transition

More from this source