FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Is AGS an SSO solution; can it be used as an identity provider (IdP)? ​

Short answer

AGS provides SSO for the applications published on TR7, but it is not an identity provider (IdP). SSO within TR7 is set up by having the session opened on a vService in Portal mode accepted, without a new login being requested, on the Portal Application vServices that carry this portal in their Trusted Portals list. In its relationship with corporate IdPs, AGS is the party that connects: it works as a service provider (SP) in SAML 2.0 and as a client in OpenID Connect and OAuth2; it does not issue SAML assertions or tokens to external applications.

How Does It Work? ​

In AGS, "SSO" appears in three different senses:

  1. Between the applications within TR7: The user logs in once on the Portal vService; the Portal Application vServices accept the session of the portal (What is the Portal; how do users reach several applications with a single sign-in?).
  2. With a corporate IdP: AGS redirects the user to the login page of the IdP and verifies the response that comes back. If there is an open session at the IdP, whether to ask for the password again is the decision of the IdP; in SAML 2.0, while Force Re-Authentication is on, the IdP is asked to authenticate the user again.
  3. To the application's own login: Backend SSO adds the verified identity to the request to the Backend Service as a header, Basic Auth, a Bearer Token or a cookie; the application recognizes the user without asking for a separate login.

Comparison ​

NeedCounterpart in AGS
A single login to multiple applications on TR7The Portal and Portal Application modes
Login with corporate IdPs such as Microsoft, Okta, Keycloak and Auth0An Authentication Providers profile of the SAML 2.0, OpenID Connect or OAuth2 type; AGS is the SP or the client
Recognizing the user without a separate login to the applicationBackend SSO Configurations
Issuing identity to external applications (making TR7 an IdP)Not available

The general definition of the concepts: What is SSO (Single Sign-On)? · What is the difference between an IdP (Identity Provider) and an SP (Service Provider)?

SSO in TR7 ​

  • Portal side: The Gateway Mode value of a vService is set to Portal; Portal URL and Portal Applications are entered.
  • Application side: On the vService of the application, the Gateway Mode value is set to Portal Application and the portal is selected in the Trusted Portals list. A user without a session is redirected to the first portal in the list that has a Portal URL value defined.
  • Subdomains of the same application: If a single vService is published with multiple subdomains, the same session is used on these addresses by setting Cookie Domain to the parent domain.

Common Misconceptions ​

  • "AGS is installed in place of an IdP such as Keycloak or ADFS." AGS is the party that connects to these systems; it does not itself issue identity to external applications.
  • "The Portal type Authentication Provider and the Portal mode are the same thing." The Portal mode is the way a vService works; the Portal type provider, on the other hand, is the step that is added to the flow and takes the identity from a vService in Portal mode (What are the Web Form, HTTP and Portal providers for?).
  • "Backend SSO means SSO with an IdP." Backend SSO only passes the identity verified by AGS to the Backend Service; it has nothing to do with the IdP connection.

How it is done in the documentation

Related questions