When the identity provider goes down

Reconstructs what kept working during the Google (2020), Azure AD (2020, 2021), AWS Cognito (2020), Auth0 (2021) and Cloudflare Access (2025) identity outages, and what the survivors share: issuance treated as a control plane that may be absent, validation answering from locally held keys, tokens and replicated decisions, and credential lifetime managed as an explicit outage budget. A reader leaves able to choose a failure mode per enforcement point, size token lifetime as slack, and build the recovery path that does not authenticate through the thing being recovered.

What you get out of it

• Identity planes fail as ordinary infrastructure: a quota tool, a stream buffer, a key janitor, a KV store and a congested database caused the five big outages; none was an identity-specific failure.
• The survivable shape is the 1988 Kerberos split re-derived: issuance may be absent, validation verifies locally, and credential lifetime minus rotation point is exactly how long you survive; SPIRE is the only system that exposes that slack as a named config (availability_target, minimum 24h).
• Fail-open is attacker-callable: CISA documents MFA calls redirected to localhost to trigger it, and Envoy's failure_mode_allow became a bypass twice; defaults have been reversing toward fail-closed (Kubernetes v1, Duo 4.3.0).
• Fail-closed has its own catalogued failure, the recovery lockout: Gatekeeper's docs name the circular dependency, and issues #733/#3183 show clusters unable to recover through their own policy webhook.
• Degraded-mode policy only works if declared before the outage: Entra's resilience defaults are ignored if enabled mid-incident, and no project changes a failure-mode default casually (Gatekeeper's fail-closed request has been open since 2019).

Scope

Why this, now. Cloudflare's June 2025 Access outage (100% of identity logins failed for 2.5 hours because a KV store's third-party cloud failed) reopened the fail-open versus fail-closed argument that Envoy's 2023-2024 CVE pair and CISA's exploited-fail-open advisory had already sharpened.

What it does not cover. Responding to identity-provider compromise, federation protocol selection, and routine certificate expiry, each a separate problem with different instincts.