FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

What is the difference between an IdP (Identity Provider) and an SP (Service Provider)? ​

Short answer

The IdP (Identity Provider) is the party that verifies the user and provides the identity information; the user enters the password and the second factor here (such as Microsoft Entra ID, ADFS, Okta, Keycloak). The SP (Service Provider), on the other hand, is the application that grants the user access by trusting the identity provided by the IdP; it never sees the password. The two parties know each other in advance: the SP knows the IdP's address, identity and signing certificate; the IdP, in turn, knows the SP's identity and the address it will send the response to. TR7 AGS is in the SP role in the SAML 2.0-type Authentication Provider: the IdP information is entered in the IdP Single Sign-on URL, IdP Entity ID (issuer) and IdP Signing Certificate fields; TR7's own information, SP Entity ID and Assertion Consumer Service URL, is written in the application record in the IdP.

Where It Is Used in TR7 ​

WhereField / labelWhat for
AGS → Authentication → Authentication Providers (SAML 2.0)IdP Single Sign-on URL, IdP Entity ID (issuer), IdP Signing CertificateThe information belonging to the IdP; it can be filled in from the IdP metadata with Import Metadata
AGS → Authentication → Authentication Providers (SAML 2.0)SP Entity ID, Assertion Consumer Service URLTR7's identity as the SP and the address the IdP response returns to
AGS → Authentication → Authentication Providers (OAuth2, OpenID Connect)OAuth Provider, Client ID, Redirect URIThe OAuth and OpenID Connect equivalent of the same relationship: the provider provides the identity, and TR7 trusts it as a registered client

Comparison ​

IdPSP
RoleVerifies the user, signs and sends the identity informationTrusts the identity and grants access
Does it see the passwordYesNo
Information it knowsSP Entity ID, Assertion Consumer Service URLIdP Single Sign-on URL, IdP entity ID, IdP Signing Certificate
ExampleEntra ID, ADFS, Okta, KeycloakTR7 AGS, SaaS applications

Common Misconceptions ​

  • "In the SAML flow, TR7 verifies the user." In the SAML 2.0 type, the external IdP verifies the user; TR7, as the SP, verifies the IdP's signed response and reads the user information from it.
  • "The IdP and the SP share the same certificate." The IdP signs the responses with its own private key; the SP holds only the certificate (public key) that will verify this signature.
  • "The SP entity ID must be a reachable web address." The entity ID is a unique URI by which the IdP recognizes the SP; it is mostly written in URL form, but a page does not need to exist at that address. What matters is that the value is exactly the same on both sides; TR7 also uses this value as the expected audience of the assertion.

How it is done in the documentation

Related questions