What do the Portal Access Mode options (Domain Tunnel, TR7 Application, Private Domain Tunnel) mean?

Short answer

Access Mode determines how each application in the Portal Applications list is accessed on a vService in Portal mode. Domain Tunnel (default) publishes the application with its own domain name over the portal vService and tunnels the requests with a session to the vService of the application. In TR7 Application, the application is accessed directly from its own vService address; the portal session is accepted by the vService of the application in Portal Application mode. Private Domain Tunnel, on the other hand, publishes the application at an address specific to the user or to the session under Private Tunnel Domain.

How Does It Work?

• Domain tunnel: All the requests that come to the Application URL domain name and carry a valid portal session are tunneled to the Application vService without a path distinction. The user who has no session is redirected to the portal; if the domain name is outside the Cookie Domain value of the portal, the session is carried over the handoff address of the portal.
• TR7 application: The user goes to the application's own vService address. If the user has no session, the vService of the application redirects the user to the portal in the Trusted Portals list; the session opened at the portal is carried to the application.
• Private domain tunnel: The application is served at an address formed under Private Tunnel Domain with a 12-character label generated according to the user or to the session (e.g. 3f9c2a7b1d0e.portal.example.com). If the label matches, the request is tunneled to the Application vService; at an address that does not match, a user with a session gets HTTP 404, and a user who has no session is redirected to the portal.

Comparison

	Domain tunnel	TR7 application	Private Domain Tunnel
The address of the application	The domain name in Application URL	Application URL (the application vService's own address)	An address specific to the user or to the session under Private Tunnel Domain
The path of the traffic	Portal vService → tunnel → Application vService	Directly to the Application vService	Portal vService → tunnel → Application vService
DNS and certificate	The application domain name resolves to the portal vService; the certificate of the portal vService covers this domain name	On the application's own vService	The wildcard record (*. Private Tunnel Domain) resolves to the portal vService; the certificate covers the wildcard domain name
The mode of the Application vService	AGS off (if the domain name is under Cookie Domain) or Portal Application	Portal Application	AGS off or Portal Application

Access Mode in TR7

Access Mode is selected separately for each application in the Portal Applications cards that appear while Gateway Mode is Portal, in the General Settings window on the Flowchart tab of the AGS-enabled vService:

Field	Domain tunnel	TR7 application	Private Domain Tunnel
Application Name	Mandatory	Mandatory	Mandatory
Application URL	Mandatory	Mandatory	Not displayed
Application vService (only HTTP vServices)	Mandatory	Mandatory	Mandatory
Address Scope	Not displayed	Not displayed	Per User (Stable Address) (default) or Per Session (Rotates Every Login)

For Private Domain Tunnel, Private Tunnel Domain is entered on the portal vService; this domain name must be under the Cookie Domain value of the portal, otherwise the portal session cookie does not reach the application addresses.

Common Misconceptions

• "When TR7 application is selected, the portal protects the application." No rule is created on the portal side; the application is protected by the Portal Application mode and the Trusted Portals list on its own vService.
• "In Domain tunnel, the user logs in to the application separately." The tunneled request comes with the portal session; if AGS is off on the vService of the application, or if the vService carries the portal in its Trusted Portals list, no new login is requested.
• "A Private domain tunnel address can be shared with another user." The address is generated according to the user or to the session; when another user opens the same address, that user cannot reach the application.

How it is done in the documentation

• Portal · Access Mode
• Portal · The Comparison of the Access Modes
• Portal · The Access Modes
• Portal · The Portal Applications Card

Related questions

• What is the Portal; how do users reach several applications with a single sign-in?
• What is Gateway Mode; what is the difference between Standalone Application, Portal and Portal Application?
• Is AGS an SSO solution; can it be used as an identity provider (IdP)?