What is an Authentication Provider; which provider types does AGS support?

Short answer

An Authentication Provider is the profile that determines where and how the user's identity is verified in the AGS access flow; it is added to the flow as an Authentication Provider step, and the result continues the flow from the SUCCESS or FAILURE output. Provider Type has nine types: OAuth2, OpenID Connect, SAML 2.0, LDAP, HTTP, Local Database, RADIUS, Portal and Web Form. The profile is defined once device-wide and is used in the flows of multiple AGS-enabled vServices.

How Does It Work?

1. The profile is defined on the AGS → Authentication → Authentication Providers screen; the Provider Type selection determines the fields in the form.
2. The profile is selected in the Authentication Provider step in the vService's Flowchart. The same flow can contain more than one provider step.
3. In the types that take a password, the values the user writes in the login form are passed to the provider with %AGS_USER_INPUT(username) and %AGS_USER_INPUT(password); in OAuth2, OpenID Connect and SAML 2.0, the user is redirected to the page of the external identity provider and enters the password there.
4. If the verification is successful, the user information (username, e-mail, groups…) is written to the session and the flow continues from the SUCCESS output; if it is not, from the FAILURE output.

Provider Types in TR7

Where the identity is verified	Provider Type	Additional requirement
In the organization's directory, RADIUS or HTTP service	LDAP, RADIUS, HTTP	An Authentication Server record
In local accounts on TR7	Local Database	User Database (Local Databases)
At an external identity provider (by redirection)	OAuth2, OpenID Connect, SAML 2.0	For OAuth2 and OpenID Connect, a client registration and Namespace; 14 built-in OAuth providers are available
In the login form of an existing web application	Web Form	The login form address and fields, Namespace
On another AGS-enabled vService in portal mode	Portal	Portal Gateway

There are two sections common to all types:

• User Attribute Mapping: The fields returned by the provider are mapped to session attributes. In LDAP, HTTP, SAML 2.0, OAuth2, OpenID Connect and Local Database, automatic mapping comes ready; in RADIUS, Web Form and Portal, the attributes are mapped with Custom User Attribute Mapping.
• Lockout Behavior: Determines with which lockout policies the failed attempts on this provider are counted; the default is Use Gateway Defaults (What is an Account Lockout Policy; how does account lockout work?).

Common Misconceptions

• "Once a provider is defined, login is enabled automatically." The profile is not used unless it is selected in the Authentication Provider step in the Flowchart of a vService.
• "In every type, the password comes to TR7." In OAuth2, OpenID Connect and SAML 2.0, the user enters the password on the page of the identity provider; TR7 verifies only the response that comes back.
• "A provider and an authentication server are the same thing." The server record carries only the connection information (address, port, TLS); how the verification is done is defined in the provider (What is the difference between an Authentication Provider and an authentication server?).

How it is done in the documentation

• Authentication Providers · What Are Authentication Providers?
• Authentication Providers · Provider Type Options
• Authentication Providers · Operating Mechanism
• Flowchart · Authentication Provider

Related questions

• How is a choice made between the LDAP, RADIUS, SAML 2.0, OAuth2 and OpenID Connect providers?
• What are the Web Form, HTTP and Portal providers for?
• What is the Flowchart; which step types does an AGS flow consist of?
• What is the difference between authentication and authorization?