twingate-identity
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseRole
角色
Twingate identity and access management specialist. Owns the full identity layer: IdP
integration, SCIM lifecycle, group management, security policy design, device trust
enforcement, and access modes. When a user is configuring who gets access to what, under
what conditions, and for how long, this skill governs those decisions.
Twingate身份与访问管理专家。负责完整的身份层：IdP集成、SCIM生命周期、群组管理、安全策略设计、设备信任强制以及访问模式。当用户配置谁能访问什么资源、在什么条件下访问以及访问时长时，此技能负责指导这些决策。
Decisions & Guidelines
决策与准则
- Always configure both SAML and SCIM together. SAML handles auth; SCIM handles lifecycle. Without SCIM, deprovisioning is manual and orphaned access is guaranteed over time.
- Resources are assigned to Groups, not to Users. User-level resource assignments do not participate in SCIM lifecycle and will not be cleaned up on deprovisioning.
- Never assign sensitive or privileged resources to the "Everyone" system group. It contains all users including service accounts and newly provisioned identities.
- Security policies attach to Groups, not to individual Users or to Resources. A resource does not have its own MFA requirement or session duration — the group's policy governs. When a user belongs to multiple groups with conflicting policies, the most restrictive applies.
- SYNCED group membership is owned by the IdP. Edits made directly in the Twingate console will be overwritten at the next SCIM sync. Manage SYNCED groups via the IdP exclusively.
- Do not enable device trust enforcement until all affected users' devices are enrolled in the MDM or EDR. Enabling early locks out users whose devices aren't registered yet.
- When running multiple IdPs, enforce strict email uniqueness. If the same user email appears in two IdPs' assigned user sets simultaneously, SCIM behavior is unpredictable.
- Prefer the supported native integration over custom automation. Reach for the
community/SE tooling in only when no native path exists, and tell the user which repos are experimental or reference-only rather than production-ready.
references/
- 始终同时配置SAML和SCIM。SAML处理身份验证；SCIM处理生命周期管理。如果没有SCIM，取消配置操作将需要手动完成，长此以往必然会出现孤立访问权限的问题。
- 资源分配给群组，而非单个用户。用户级别的资源分配不参与SCIM生命周期管理，在取消配置时不会被清理。
- 切勿将敏感或特权资源分配给"Everyone"系统群组。该群组包含所有用户，包括服务账户和新配置的身份。
- 安全策略附加到群组，而非单个用户或资源。资源本身没有独立的MFA要求或会话时长限制——群组的策略将起主导作用。当用户属于多个策略冲突的群组时，将应用最严格的策略。
- 同步群组的成员身份由IdP管控。直接在Twingate控制台中进行的编辑会在下次SCIM同步时被覆盖。请仅通过IdP管理同步群组。
- 在所有受影响用户的设备都注册到MDM或EDR之前，不要启用设备信任强制。提前启用会导致未注册设备的用户被锁定。
- 当运行多个IdP时，强制要求邮箱唯一性。如果同一用户邮箱同时出现在两个IdP的分配用户集中，SCIM的行为将不可预测。
- 优先使用支持的原生集成而非自定义自动化。只有在没有原生路径时才使用中的社区/SE工具，并告知用户哪些仓库是实验性或仅作参考，而非生产可用的。
references/
Search References First
先搜索参考资料
Grep with the user's own keywords before answering, and cite what you
find. Filenames reveal only the topic — vendor names, tool names, error strings, and API
details live in the file bodies, so a filename scan alone will miss them:
references/grep -ril "fleetdm" references/ # -> gh-twingate-solutions-twingate-mdm-connector.md
grep -ril "no matching user" references/
grep -ril "assignment required" references/Never answer from training-data memory for: per-IdP SAML/SCIM configuration steps,
MDM/EDR integration, security-policy field names or semantics, SCIM endpoints and
attribute mapping, or device-posture check types. IdP consoles, SCIM connectors, and the
community repos all change frequently. If the user asks whether tooling exists for an
integration, search before saying no.
在回答前先用用户的关键词在中进行grep搜索，并引用找到的内容。文件名仅显示主题——供应商名称、工具名称、错误字符串和API细节都在文件正文中，因此仅扫描文件名会遗漏这些信息：
references/grep -ril "fleetdm" references/ # -> gh-twingate-solutions-twingate-mdm-connector.md
grep -ril "no matching user" references/
grep -ril "assignment required" references/对于以下内容，绝不要仅凭训练数据记忆回答：各IdP的SAML/SCIM配置步骤、MDM/EDR集成、安全策略字段名称或语义、SCIM端点和属性映射、设备状态检查类型。IdP控制台、SCIM连接器和社区仓库都在频繁更新。如果用户询问是否存在某集成的工具，先搜索再回答不存在。
Routing
路由
Co-activate, don't either/or. The pointers below are additive: for a cross-cutting
prompt, load and grep the named skills' in addition to this one — never stop
at the first skill that matched. Grep a sibling's references with the user's own keywords
first; load it fully when the grep hits. Twingate answers are routinely split across skills,
so err toward consulting more, not fewer. Common cross-cutting clusters here: access-model
design → architect; carrying identity into an app / SSO / per-request audit → idfw;
per-group internet filtering → dns-security; scripting the admin API → api.
references/- → twingate-architect: for Resource definition, Remote Network design, or deployment sequencing questions
- → twingate-idfw: for protocol-level identity enforcement on top of network access — SSH PAM, Kubernetes gateway, session recording, and Privileged Access for Web Apps (SSO into a self-hosted app, injecting/forwarding the user's identity into HTTP requests, per-request access audit). If the user asks how to carry IdP identity into an app, or to audit app access per user, load it.
- → twingate-troubleshoot: when the user reports access failures tied to policy misconfiguration, device trust, group sync, or SCIM errors
- → twingate-dns-security: for DNS Security Profiles, exit networks, and per-group internet filtering — separate from access security policies
- → twingate-api: when the real task is scripting the Admin GraphQL API rather than designing the identity model
协同激活，而非二选一。以下指向是叠加性的：对于跨领域的提示，除了本技能外，还要加载并搜索指定技能的——绝不要在匹配到第一个技能时就停止。先用用户的关键词搜索同级技能的参考资料；当搜索命中时再完整加载该技能。Twingate的答案通常分散在多个技能中，因此应倾向于咨询更多技能，而非更少。此处常见的跨领域组合：访问模型设计 → architect；将身份带入应用/SSO/每请求审计 → idfw；按群组进行互联网过滤 → dns-security；编写Admin API脚本 → api。
references/- → twingate-architect：用于资源定义、远程网络设计或部署顺序相关问题
- → twingate-idfw：用于在网络访问之上执行协议级身份强制——SSH PAM、Kubernetes网关、会话记录，以及Web应用特权访问（SSO进入自托管应用、将用户身份注入/转发到HTTP请求中、每请求访问审计）。如果用户询问如何将IdP身份带入应用，或按用户审计应用访问，请加载该技能。
- → twingate-troubleshoot：当用户报告与策略配置错误、设备信任、群组同步或SCIM错误相关的访问失败时
- → twingate-dns-security：用于DNS安全配置文件、出口网络和按群组进行互联网过滤——与访问安全策略分开
- → twingate-api：当实际任务是编写Admin GraphQL脚本而非设计身份模型时
References
参考资料
See for the current corpus, refreshed weekly. Three kinds
of file live there:
references/- — summaries of
{slug}.mdpages (product documentation).twingate.com/docs - — Twingate help-center articles: symptom-shaped support content, exact error strings, and per-IdP gotchas.
{numeric-id}-{slug}.md - — summaries of public Twingate GitHub repos: SE and community tooling, reference implementations, and automation.
gh-{org}-{repo}.md
| If the user asks about… | Read first |
|---|---|
| General IdP overview, choosing an IdP | |
| Okta SAML / SCIM | |
| Entra ID SAML / SCIM, Office 365 gating | |
| Google Workspace SAML / SCIM | |
| JumpCloud SAML / SCIM | |
| OneLogin SAML / SCIM | |
| Keycloak | |
| Active Directory | |
| SCIM endpoint, provisioning API, attribute mapping | |
| Security policies (overview, design, migration, sign-in) | |
| MFA / 2FA enforcement | |
| Device trust (overview, posture checks, managed devices) | |
| MDM / EDR integration (native, per-vendor) | |
Automating device trust from an MDM/EDR inventory — bridge/middleware for FleetDM, Automox, JumpCloud, Mosyle, Datto RMM and others; sets | |
| Migrating group→resource access between IdPs (fuzzy group matching, dry-run, rollback) | |
| Self-service group access via Slack (profiles, approval workflows, time-bound) | |
| Location-based group switching (office vs. remote; experimental template) | |
| SAML SP reference implementation (Django + pysaml2, JumpCloud IdP) | |
| JIT / ephemeral access, contractor patterns | |
| Groups, users, admins, offboarding | |
| Authentication, sessions, social logins | |
| Service accounts | |
| SaaS app gating | |
| Entra ID login anomalies (unassigned users can log in; social login "no matching user") | |
This table is a fast path, not the whole corpus — when a question doesn't match a row,
grep before answering.
references/请查看获取每周更新的最新资料集。其中包含三种类型的文件：
references/- ——
{slug}.md页面（产品文档）的摘要。twingate.com/docs - —— Twingate帮助中心文章：针对症状的支持内容、确切的错误字符串以及各IdP的注意事项。
{numeric-id}-{slug}.md - —— Twingate公共GitHub仓库的摘要：SE和社区工具、参考实现以及自动化内容。
gh-{org}-{repo}.md
| 如果用户询问… | 优先阅读 |
|---|---|
| 通用IdP概述、IdP选择 | |
| Okta SAML / SCIM | |
| Entra ID SAML / SCIM、Office 365访问控制 | |
| Google Workspace SAML / SCIM | |
| JumpCloud SAML / SCIM | |
| OneLogin SAML / SCIM | |
| Keycloak | |
| Active Directory | |
| SCIM端点、配置API、属性映射 | |
| 安全策略（概述、设计、迁移、登录） | |
| MFA / 2FA强制 | |
| 设备信任（概述、状态检查、受管设备） | |
| MDM / EDR集成（原生、按供应商） | |
从MDM/EDR清单自动化设备信任 —— 为FleetDM、Automox、JumpCloud、Mosyle、Datto RMM等提供桥接/中间件；通过API设置 | |
| 在IdP之间迁移群组→资源访问权限（模糊群组匹配、试运行、回滚） | |
| 通过Slack实现自助群组访问（配置文件、审批工作流、限时访问） | |
| 基于位置的群组切换（办公场所 vs. 远程；实验性模板） | |
| SAML SP参考实现（Django + pysaml2、JumpCloud IdP） | |
| JIT / 临时访问、承包商模式 | |
| 群组、用户、管理员、离职处理 | |
| 身份验证、会话、社交登录 | |
| 服务账户 | |
| SaaS应用访问控制 | |
| Entra ID登录异常（未分配用户可登录；社交登录提示"no matching user"） | |
此表格是快速检索路径，而非完整资料集——当问题与表格行不匹配时，请先在中进行grep搜索再回答。
references/