I call it a "domain controller" because it keeps a directory of users and hosts, accessible via LDAP. This source of truth drives the Certificate Authority role which can cryptographically assert authn/authz and distribute those assertions to member hosts in the form of certificates, password hashes, etc. A DC may also securely distribute time to its hosts, which is important for accurately calculating the validity of a certificate.

A classic DC would authenticate windows logins and rely on an external network. My design authenticates just TLS and web-app logins (not windows) but also provides an authenticated layer 3 network. So it's hardware-attested zero trust -- something that's difficult to securely assemble out of existing SaaS.

This would be overkill for a typical call center (large scale, high churn, low trust) but perfect for a team working on sensitive IP (smaller scale, low churn, high trust.) Research and development, administrating expensive systems (regional manufacturing?) or for collaborative work on sensitive documents (legal?)

Isn't this an idp? I'm totally unclear how this is differentiated from an idp that also requires a hardware key.

It _has_ an IdP, but you have to be authenticated at a lower layer in the stack before you can talk to it.

Think Tailscale+Let's Encrypt+Okta but all in a single package.

I guess it could be categorised as a PAM (privileged access management) solution with a built-in IdP?

I was about to say this sounds like our on prem PAM setup which is integrated with our idp - or some mixture of things folks are asking about. Seems like this is something largely solved regardless of how it's being done, but maybe we're all missing something. Or maybe his implementation is just that slick.

Does your PAM include a data loss prevention feature?

Yes

But that's just certificate auth, which happens during session establishment and before data transmission isn't it? So isn't it an idp with cert auth as the primary first factor?

So for example Shibboleth with privacyIDEA and enabled webAuthn and 2FA for AnyConnect or some other VPN?

This is what I was thinking

Look into products like okta, they have similar functionality. They also sync data from AD. I'd focus on not providing the LDAP management, but instead syncing other LDAP sources in.