What is the difference between an Authentication Provider and an authentication server?

Short answer

An Authentication Server is the connection record of a directory or a service: the protocol, the addresses and ports, the distribution method across the addresses, TLS verification, the timeout and the RADIUS Shared Secret are kept here. An Authentication Provider, on the other hand, defines how the verification is done (the LDAP bind method and search filters, the HTTP request, the RADIUS authentication type, attribute mapping, lockout behavior) and is the profile that is added to the access flow. Only providers of the LDAP, HTTP and RADIUS types use the server record; one server record is shared by multiple providers.

How Does It Work?

1. A server record is created on the AGS → Authentication → Authentication Servers screen: Protocol (LDAP, LDAPS, RADIUS, HTTP, HTTPS) and Server Hosts are entered.
2. This record is selected in the Authentication Server field of a provider of the LDAP, HTTP or RADIUS type.
3. When the provider runs in the flow, the connection is made to the addresses in the record; if there are multiple addresses, the connections are distributed with Load Balancing Method.

Comparison

	Authentication Server	Authentication Provider
Question	Where to connect, and how?	How is the user verified?
Information it holds	Address:port list, distribution method, TLS settings, timeout, connection pool, RADIUS Shared Secret	Verification method, username and password variables, search/request details, attribute mapping, lockout behavior
In which types	LDAP / LDAPS, RADIUS, HTTP / HTTPS	All nine provider types; only LDAP, RADIUS and HTTP use the server record
Place in the flow	Not added to the flow directly	Selected in the Authentication Provider step
Sharing	One record is used in multiple providers	One profile is used in the flows of multiple vServices

Authentication Servers in TR7

Field	Values
Server Hosts	One or more Host address and Port entries; a Weight on each row (1–10, default 1)
Load Balancing Method	Round robin (default), Weighted Round Robin, Failover
Validate SSL Certificate, Minimum TLS Version	Only in LDAPS and HTTPS; on and 1.2 by default
Connection Timeout (s), Connection Pool Size	Default 30 seconds and 5 connections
RADIUS Shared Secret	Only in RADIUS, required (What is the shared secret in RADIUS and TACACS+?)

The connection to LDAP and LDAPS records is tested from the device with Test Connection in the preview of the record; the same test is also available in the preview of the LDAP provider.

Common Misconceptions

• "A separate server record is created for each provider." The same Active Directory servers are defined with a single record and used in multiple LDAP providers with different search settings; an address change is made from a single place.
• "OAuth2, OpenID Connect or SAML 2.0 also needs a server record." These types do not use a server record; the endpoint addresses are in the provider's own form (or in the built-in provider catalog). Local Database uses the User Database field, and Portal uses the Portal Gateway field.
• "The Authentication Server selector lists only the records with a suitable protocol." The selector in the provider form lists all server records; for an LDAP provider, a record with the LDAP or LDAPS protocol is selected, for RADIUS one with RADIUS, and for HTTP one with HTTP or HTTPS.

How it is done in the documentation

• Authentication Servers · What Are Authentication Servers?
• Authentication Servers · Profile Add Form
• Authentication Providers · Provider Type Options

Related questions

• What is an Authentication Provider; which provider types does AGS support?
• How is a choice made between the LDAP, RADIUS, SAML 2.0, OAuth2 and OpenID Connect providers?
• What is the difference between LDAP and LDAPS?