Cloud, on-premises or mixed
Run the CoreService in your chosen infrastructure. Existing systems can remain in place while the identity lifecycle is managed centrally.
CLOUD · ON-PREMISES · HYBRID
Your IT strategy determines deployment.
SYNRION x.ID supports cloud-first strategies, fully on-premises operation and hybrid architectures. The web-based CoreService and deliberately placed Outpost connectors link the required systems. Employees and administrators use the portal in a browser, including on tablets and smartphones.
VALUE IN 30 SECONDS
A deployment model that fits your strategy.
Outposts connect environments
Outpost connectors perform defined tasks close to directories, CAs and separated networks. Microsoft Entra ID integrates natively, with authenticated communication.
Work in a browser, including on mobile
The portal works on desktop, tablet and smartphone. Specific YubiKey operations additionally depend on supported devices, browsers and connection paths.
FROM ONE SERVER TO DISTRIBUTED CONTROL
How does x.ID grow across directories, CAs and network boundaries?
Start with the customer’s strategy, operational responsibilities and network boundaries. Then place the CoreService and Outpost connectors accordingly. One consistent identity and policy model connects cloud, on-premises and mixed environments.
-
01
Connect identity sources natively
Connect on-premises Active Directory through the LDAP Connector and Microsoft Entra ID directly through the native Azure Connector so users, computers and assigned credentials can be controlled together.
-
02
Publish the certificate and strong mapping
After successful issue, establish the target state not only in x.ID but also in the intended Microsoft identity systems.
-
03
Place connector roles deliberately
Deploy Outposts where CA, directory or policy functions need a controlled local connection across a trust or network boundary.
-
04
Authenticate every Outpost path
Use mutually authenticated TLS so both ends of the connection are known and the transport remains encrypted.
-
05
Connect multiple certification authorities
Add existing internal or public CA paths without creating a separate identity lifecycle for each issuing system.
-
06
Integrate clients and external systems
The x.ID Agent runs on the client or on a jump host with supported smart card redirection. No local installation does not mean no agent. The YubiKey stays at the user’s computer; the agent communicates with the Core over mTLS.
-
07
Expand topology without losing oversight
Connect Outposts as a star, a chain or a mixed topology to reach networks with several layers of segmentation. Administrators can see which Outposts are connected.
THE ARCHITECTURE AT A GLANCE
Connect AD, Entra and CAs natively; arrange Outposts as a star, a chain or a mix of both.
TECHNICAL DEPTH
The connector roles stay explicit.
An Outpost is not a generic tunnel. Each role has a defined responsibility and should receive only the access required for that function.
- CA Connector
- The CA Connector executes issuance and revocation with the relevant CA. A revocation includes its reason and immediate CRL publication. LDAP and Azure Connectors remove the affected certificate entries and mappings in their target systems.
- LDAP Connector
- Reads AD identity context, publishes certificates in userCertificate and maintains strong X509:<SKI> mappings in altSecurityIdentities. On withdrawal, affected entries are removed. The gMSA receives targeted attribute permissions in the intended OUs.
- Azure Connector
- The native Azure Connector accesses Microsoft Entra ID directly through Microsoft Graph, without requiring AD synchronization. For Entra CBA it maintains SKI mappings in certificateUserIds. Entra FIDO2 pre-provisioning combines tenant registration with a separate personal PIN handover.
- Policy Enforcement
- Evaluates independent rules close to the controlled environment so trust does not depend only on a target application or a single directory attribute.
- mTLS and gMSA
- mTLS authenticates both connection endpoints. A gMSA can provide a managed Windows service account, while hardware protection can strengthen the private key used by privileged services.
- Bidirectional APIs
- External systems can connect to SYNRION. Other platforms can use operational and reporting data through the API when the querying role has the required permissions.
- Temporary disruptions
- If a target is temporarily unreachable, x.ID retains the request and automatically resumes processing as soon as connectivity returns. This covers revocation and directory cleanup. The normal revocation process executes immediately.
EVIDENCE & BOUNDARIES
What remains visible across the hybrid environment.
The architecture separates technical reach from trust authority. A connector can perform its task without becoming an uncontrolled master of the whole identity environment.
Users and computers across sources
On-premises AD domains, Microsoft Entra ID and systems outside a traditional AD join remain visible through their respective connector paths.
Consistent Microsoft target state
One revocation action combines CA revocation and CRL publication with cleanup of affected certificate entries and mappings in AD/LDAP, the Windows certificate store and Entra CBA.
Multiple CAs in one policy model
Issuing systems can differ while identity, approval and lifecycle context remain consistent.
Authenticated connector communication
Outpost paths use mTLS and explicit service identities instead of anonymous infrastructure access.
RELATED PRODUCT
SYNRION x.ID
Manage YubiKeys, identities, PIV certificates and FIDO2 centrally in a browser. SYNRION x.ID combines native Entra integration with cloud, on-premises or hybrid deployment through Outpost connectors. The portal also supports mobile access; the feature overview states release status and requirements.
THE NEXT CONTROLLED STEP
Bring your IT strategy. We will map the architecture to it.
Together, we define where the CoreService runs, which Outpost roles are needed and how users access the portal and their devices.