What is the Flowchart; which step types does an AGS flow consist of?

Short answer

Flowchart is the tab on which the login flow of an AGS-enabled vService is drawn as steps and connections; the user who has no session enters the flow from the step to which the Start box is connected. Eight step types are added with Add AGS Action: Form, MFA, Authentication Provider, Decision Point, Allow, Deny, Assign User Attributes and Switch. If the flow ends with Allow, the session is opened, and if it ends with Deny, access is denied; the steps in between continue from different outputs according to their results. The changes are made in Edit Mode and are not applied until they are saved with Save.

How Does It Work?

Each step is a box, and the transitions are the arrows that connect the boxes. When the user completes a step, the user moves to the next step from the output that corresponds to its result:

Step	What it does	Its outputs
Form	Shows the form in a Login Forms profile; the entered values are used in the following steps with %AGS_USER_INPUT(field name)	A single output
Authentication Provider	Verifies the identity with the selected Authentication Providers profile	SUCCESS, FAILURE
MFA	Verifies the second factor with the selected MFA profile	SUCCESS, FAILURE
Decision Point	Evaluates the selected Conditions records	YES, NO
Switch	Compares the Switch Variable value with the branch patterns	An output for each branch, and noMatch
Assign User Attributes	Writes a user attribute to the session; does not verify the identity	A single output
Allow	Ends the flow with access permission; the session is opened	None
Deny	Ends the flow with access denial	None

There are two more boxes that cannot be added in the diagram: Start is the entry point of the flow and is not displayed in Portal Application mode; Backend SSO (Re)Sync, on the other hand, is displayed when the Backend Session Lost Strategy value is Re-sync in the connected Backend SSO profile.

Flowchart in TR7

• The tab is reached via Left Monitor Panel → AGS-Enabled vServices → vService → Flowchart (accessing the Flowchart); the tab opens in View Mode.
• In Edit Mode, Add AGS Action adds a new step, and General Settings opens the vService's AGS settings that are outside the flow.
• More than one step of the same type can be used; for example, by connecting the FAILURE output of a provider to a second provider, the user is looked up in two sources.
• The User Attributes panel on the right shows which step assigns and reads which user attribute.
• When AGS is turned on, the flow comes with the Basic Login form and the Deny step; there is an Allow step, but it is not connected (What happens to traffic when AGS is enabled on a vService?).

Common Misconceptions

• "The Form step verifies the user." Form only collects the information and has a single output; the verification is done in the Authentication Provider step.
• "Pressing Accept puts the flow into effect." Accept in the Add AGS Action, Edit AGS Action and General Settings windows changes only the diagram; the flow is saved with Save.
• "Decision Point and Switch do the same job." Decision Point splits the flow into two branches according to a condition, and Switch into many branches according to a value (What is the difference between Decision Point and Switch in the Flowchart?).

How it is done in the documentation

• Flowchart · What Is Flowchart?
• Flowchart · How Does the Flow Work?
• Flowchart · Action Types
• AGS - AAM · Access Flow

Related questions

• What is the difference between Decision Point and Switch in the Flowchart?
• What happens to traffic when AGS is enabled on a vService?
• What is an Authentication Provider; which provider types does AGS support?
• How does MFA work in AGS; which methods are available?