Where does authentication happen: in TR7, in the application or at the identity provider?

Short answer

The login flow is always run in TR7, by AGS: the login page, MFA, account lockout and the session are in TR7. Who verifies the identity is determined by the Authentication Provider type in the flow: with Local Database, TR7; with LDAP, RADIUS and HTTP, the organization's server; with OAuth2, OpenID Connect and SAML 2.0, an external identity provider (IdP); with Web Form, the application's own login form; with Portal, a vService in Portal mode. AGS evaluates the result and AGS opens the session; the application sees the identity only when it is passed with Backend SSO.

How Does It Work?

1. A user without a session is taken into the Flowchart flow of the vService.
2. The Authentication Provider step runs the selected provider. In the types that ask for a username and password, the credentials are taken from the login form of AGS (the Form step); with OAuth2, OpenID Connect and SAML 2.0, the user is redirected to the login page of the IdP and the response that comes back is verified in AGS.
3. Depending on the result, the flow continues from the SUCCESS or FAILURE output of the step; by connecting the FAILURE output to another provider step, the user can be looked up in a second source.
4. If needed, the MFA step runs; when the flow ends with Allow, the session is opened and the verification is not repeated in the subsequent requests.

Comparison

Authentication Provider type	Who verifies the identity	Record required in TR7
Local Database	TR7	A Local Databases record
LDAP, RADIUS, HTTP	The organization's directory, RADIUS or verification server	An Authentication Servers record
OAuth2, OpenID Connect	The external provider; the login is done on the provider's page	The client information in the provider profile
SAML 2.0	The IdP; the login is done on the IdP's page	The IdP information in the provider profile and SP Entity ID
Web Form	The application's own login form	The form address and fields in the provider profile
Portal	The flow of the vService in Portal mode	The Portal Gateway selection

Authentication in TR7

• Providers are defined on the Configuration Menu → AGS → Authentication Providers screen and bound to the Authentication Provider step in the Flowchart; more than one provider can be used in the same flow.
• Failed attempts are counted in AGS with Account Lockout Policies and the lock is applied in AGS; the active locks are monitored on the Lockout tab, the attempts on the Audit Logs tab and the open sessions on the Sessions tab.

Common Misconceptions

• "When LDAP is selected, the passwords are stored in TR7." In the LDAP, RADIUS and HTTP types, the password is verified on the organization's server; the only type in which accounts are kept in TR7 is Local Database.
• "With SAML 2.0 or OpenID Connect, the user writes the password into the form of AGS." The user is redirected to the login page of the IdP; AGS verifies the response returned from the IdP.
• "When AGS is enabled, the application's own login screen goes away by itself." AGS does not change the login of the application; if the application keeps asking for a login, the identity is passed with Backend SSO, or the verification is done with Web Form in the application's form (If I put AGS in front of my application, does the application need code changes?).

How it is done in the documentation

• AGS - AAM · Where Is Authentication Performed?
• AGS - AAM · Authentication Options
• Authentication Providers · Provider Type
• Authentication Servers · What Are Authentication Servers?

Related questions

• What is an Authentication Provider; which provider types does AGS support?
• How is a choice made between the LDAP, RADIUS, SAML 2.0, OAuth2 and OpenID Connect providers?
• Is AGS an SSO solution; can it be used as an identity provider (IdP)?
• What is the difference between an IdP (Identity Provider) and an SP (Service Provider)?