How is a choice made between the LDAP, RADIUS, SAML 2.0, OAuth2 and OpenID Connect providers?

Short answer

The choice is determined by where the user identities are kept today. If the users are in Active Directory or OpenLDAP, LDAP is selected; if they are verified on a RADIUS server (NPS, FreeRADIUS, OTP servers that speak RADIUS), RADIUS is selected; in these two types, the password is written in the login form of TR7 and verified by TR7 on the server. If the organization has an identity provider that speaks SAML or OpenID Connect (Entra ID, ADFS, Keycloak, Okta…), the user is redirected to that provider and the password does not come to TR7: SAML 2.0 is used in a SAML-based infrastructure, and OpenID Connect with a provider that supports OpenID Connect. OAuth2 is selected only for providers that do not give the identity with an ID token but provide the user information from the user info endpoint (e.g. GitHub).

How Does It Work?

There are two separate verification models:

1. TR7 takes the password (LDAP, RADIUS): The user writes the username and password in the AGS login form; TR7 passes them to the directory or the RADIUS server in the Authentication Server record and moves to the SUCCESS or FAILURE output according to the response.
2. The external provider verifies the identity (SAML 2.0, OpenID Connect, OAuth2): The user is redirected to the login page of the provider, logs in there and returns to TR7; TR7 verifies the returned SAML response or the tokens. In this flow, the MFA and password policies of the provider are applied at the provider.

Comparison

	LDAP	RADIUS	SAML 2.0	OpenID Connect	OAuth2
Who verifies the identity	Directory server	RADIUS server	SAML IdP	OIDC provider	OAuth2 authorization server
Does the password come to TR7	Yes	Yes	No	No	No
Needed on TR7	LDAP / LDAPS server record	RADIUS server record and shared secret	IdP addresses and signing certificate	Client ID, Client secret	Client ID, Client secret
Where the identity is read from	Directory attributes, optional group search	RADIUS response; no automatic attribute mapping	Signed SAML assertion	ID token whose signature is verified	User info endpoint
Helper	Test Connection	-	Import Metadata	Fetch Endpoints from Issuer, built-in providers	Built-in providers

Provider Options in TR7

• LDAP: Authentication Method is Search and Bind (default) or Direct Bind; group memberships are fetched with Enable Group Search (What is LDAP; where is it used in TR7?).
• RADIUS: RADIUS Authentication Type is PAP (default) or CHAP; TR7 is defined as a client on the RADIUS server (What is RADIUS; where is it used in TR7?).
• SAML 2.0: TR7 is the SP in this flow; SP Entity ID and Assertion Consumer Service URL are written in the application registration on the IdP (What is SAML 2.0?).
• OpenID Connect and OAuth2: They share the same form; in the OAuth Provider field, one of the 14 built-in providers or Custom Provider is selected, and the Redirect URI address of TR7 is registered with the provider. Apple is listed only in the OpenID Connect type (What is OpenID Connect (OIDC)?).

Multiple providers can be used together in the same flow; for example, employees log in with LDAP and business partners with an OpenID Connect provider (What is the Flowchart; which step types does an AGS flow consist of?).

Common Misconceptions

• "OAuth2 and OpenID Connect are the same." OpenID Connect gives the identity as an ID token whose signature is verified with the keys at the JWKS URI address; if the provider supports it, OpenID Connect is selected (What is OAuth 2.0?).
• "SAML is mandatory for Active Directory." AD is connected to directly with LDAP; SAML 2.0 or OpenID Connect is selected if an identity provider such as ADFS or Entra ID is in front of AD and the password is preferably kept from reaching TR7.
• "RADIUS is only for logins to network devices." NPS, FreeRADIUS or MFA/OTP servers that speak RADIUS are also connected to the AGS flow with this type; the verification decision is made by the RADIUS server.

How it is done in the documentation

• Authentication Providers · Provider Type Options
• AGS - AAM · Authentication Options
• OpenID Connect · What Is OpenID Connect?
• SAML 2.0 · What Is SAML 2.0?

Related questions

• What is an Authentication Provider; which provider types does AGS support?
• What are the Web Form, HTTP and Portal providers for?
• What is the difference between an IdP (Identity Provider) and an SP (Service Provider)?
• Is AGS an SSO solution; can it be used as an identity provider (IdP)?