Centrally managing data for distributed identity-based firewalling

One or more non-transitory computer-readable storage media storing one or more sequences of program instructions which, when executed by one or more computing devices, cause performing:

• receiving, by at least one broker computing device, identity awareness data from a plurality of directory services in a federation;
• posting, by the at least one broker computing device, the identity awareness data to a distributed data repository;
• establishing, at a networking hardware device having a first type, firewall rules using the identity awareness data from the distributed data repository;
• controlling, by the networking hardware device having the first type, network traffic based on the identity awareness data.

A computer system comprising:

• a distributed data repository;
• at least one broker computing device communicatively coupled with the distributed data repository and a plurality of directory services in a federation, wherein the at least one broker computing device comprises a first non-transitory data storage medium storing a first set of instructions which, when executed by the at least one broker computing device, cause:
• receiving identity awareness data from the plurality of directory services;
• posts the identity awareness data received from the plurality of directory services to the distributed data repository;
• a networking hardware device having a first type, communicatively coupled with the distributed data repository, wherein the networking hardware device having the first type comprises a second non-transitory data storage medium storing a second set of instructions which, when executed by the networking hardware device, cause:
• establishing firewall rules using the identity awareness data from the distributed data repository;
• controlling network traffic based on the identity awareness data.