Cloud Infrastructure: IDaaS & NaaS Guide | Draftsbook

Lesson Focus & Objectives

Beyond compute and raw disk storage, modern cloud architectures rely heavily on two specialized infrastructure paradigms: Identity as a Service (IDaaS) and Network as a Service (NaaS). In a zero-trust world, identity has become the primary enterprise security perimeter, while software-defined networking decouples packet routing from physical hardware. In Part 5, we analyze SAML, OAuth 2.0, and SCIM directory protocols powering IDaaS, and investigate SDN overlays, VXLAN packet encapsulation, and virtual routing trunks defining NaaS.

1. Identity as a Service (IDaaS)

Identity as a Service (IDaaS) provides centralized authentication, directory federation, and user lifecycle governance hosted entirely in the cloud (e.g., Okta, Microsoft Entra ID, Ping Identity, Auth0). Instead of maintaining vulnerable on-premises LDAP domain controllers, organizations federate credentials across hundreds of SaaS and custom applications using modern open identity protocols:

SAML 2.0 & OIDC SSO

Enables web Single Sign-On (SSO). The Identity Provider (IdP) issues cryptographically signed XML assertions (SAML) or JSON Web Tokens (OpenID Connect) to Service Providers (SP), eliminating password sprawl and brute-force risks.

Adaptive MFA

Evaluates context-aware risk factors (geolocation anomalies, device health, IP reputation) before requesting secondary biometric or FIDO2/WebAuthn hardware tokens (YubiKey), halting credential stuffing attacks.

SCIM 2.0 Directory Sync

System for Cross-domain Identity Management. Automates employee onboarding and instant de-provisioning across all cloud apps via standardized REST JSON payloads, preventing former employee orphaned account breaches.

2. Network as a Service (NaaS)

Network as a Service (NaaS) abstracts physical routers, switches, and WAN cables into programmable API-driven software overlays. Instead of manually configuring hardware trunk ports, engineers instantiate complete multi-region enterprise networks using Terraform:

1. Software-Defined Networking (SDN) & Overlays

SDN decouples the Control Plane (which decides how packets are routed) from the Data Plane (the underlying hardware forwarding packets). Cloud providers utilize VXLAN (Virtual Extensible LAN) encapsulation to overlay millions of isolated Layer-2 virtual networks on top of standard Layer-3 IP data center fabrics.

2. SD-WAN & Dedicated Cloud Interconnects

SD-WAN dynamically routes enterprise office traffic across broadband, cellular 5G, and dedicated MPLS circuits based on real-time jitter and packet loss metrics. Direct connections (AWS Direct Connect, Azure ExpressRoute) bypass the public Internet via private 10 Gbps / 100 Gbps fiber cross-connects at carrier colocation facilities.

3. Virtual Firewalls & Network Micro-Segmentation

NaaS enforces granular security group rules at the virtual network interface card (vNIC) hypervisor level. Even if an attacker gains shell access to a frontend web server, East-West firewall rules prevent lateral movement to backend database subnets.