Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is Local Database; when does it make sense to keep users in TR7?
Short answer
Local Database is the store where AGS user accounts are kept on TR7 without an external directory or identity provider; each database carries its own password policy and the permissions for users to reset/change their own password. It is connected to the access flow with a provider of the Local Database type, and the username and password are verified in this database. It is suitable for users who are not in the corporate directory or who are not wanted in it (contractors, business partners, test and service accounts), or for small-scale applications without a directory; if the corporate users are already kept in Active Directory or an identity provider, the accounts are not duplicated in a second place, and the provider that connects to that source is used.
How Does It Work?
- On the Databases tab of the AGS → Authentication → Local Databases screen, a database is created and its password policy is set.
- On the Users tab, the database is selected and accounts are added; the password is assigned with Assign New Password and validated against the policy.
- The database is selected in the User Database field of a provider of the Local Database type; the provider is added to the flow as an Authentication Provider step.
- At login, the username and password are verified in the database; the fields of the account (name, e-mail, groups…) are written to the session with automatic mapping.
Local Databases in TR7
| Field | Default | Note |
|---|---|---|
| Minimum Password Length | 8 | 4–128 |
| Password Complexity | Basic (letter + number) | None, Basic (letter + number), Strong (upper + lower + number + symbol) |
| Prevent Password Reuse | Disabled | When enabled, the last 5 passwords (including the current one) cannot be reused |
| Allow Self Password Reset | Enabled | The user resets the password with an e-mail link; an e-mail address on the account and E-mail Settings on TR7 are required |
| Allow Self Password Change | Enabled | A signed-in user changes the password by verifying the current password |
- Passwords are stored as one-way hashes with argon2id; they are not shown on any screen.
- The username is unique within a database; the same username can be used in different databases.
- In addition to the standard user fields, the accounts hold Custom Attributes; an account is disabled with the Enabled switch.
- In a cluster setup, the databases and accounts are synchronized to the peer device (How do AGS sessions and settings behave in a cluster?).
Common Misconceptions
- "When the policy is tightened, the existing passwords are validated too." The policy is applied only to later password assignments and changes; the existing passwords do not change.
- "Local Database is the same as the TR7 management users." These accounts are used only in the AGS access flow; the management users who log in to the TR7 interface are managed on the Device Users screen.
- "The accounts remain even if the database is deleted." When the database is deleted, the accounts in it are deleted too; the providers that use the database are reviewed beforehand on the Used in tab in the preview.
- "Using Local Database also brings a second factor." The second factor is added to the flow with a separate MFA step (How does MFA work in AGS; which methods are available?).
How it is done in the documentation
