I work for a company that owns multiple factories, one of our goals is to allow every factory to continue operating even without a working internet connection. We host a single identity server 4 instance to manage our authentication and authorization. The authentication is done with windows authentication and the domain service is replicated across every factory. In our current setup when the connection to the central identity server is down our users cannot be authenticated.
We want to move to a setup where every factory will host its own version of identity server to authentication can happen even without a connection to the central service. The downside to this approach is that it makes configuration very tedious and error-prone. Most of our users require the same access in every factory, so if we need to update a user's claims or role we need to reconfigure this in every factory. We want to fix this by hosting a central identity server and push all changes to the local instances on a database level. We only want to allow one-way synchronization, so no local configuration or local to central pushing of data.
Are we on the right track with this approach or are we missing something? Are there any best practices for centralized configuration with localized hosting of identity server 4? Any ideas will be helpful.