Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is identity federation?
Short answer
Identity federation is an organization or application accepting users whose identity has been verified by another, trusted party (IdP) without opening its own user account for them. The user account and password are kept in a single place; the other parties trust this identity. The trust is established with standards such as SAML 2.0 or OpenID Connect, with metadata, certificate and client information shared between the parties in advance. In TR7 AGS, connecting to external IdPs (such as Microsoft Entra ID, Okta, Keycloak, Google, e-Devlet) with an Authentication Provider of the SAML 2.0, OpenID Connect or OAuth2 type is the counterpart of federation: the user is verified at the IdP, AGS trusts the IdP's response and writes the user information to the session with Custom User Attribute Mapping. No separate account is kept in TR7 for these users.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Providers | Provider Type = SAML 2.0, OpenID Connect, OAuth2 | Trusting the external IdP |
| Same form (SAML 2.0) | IdP Entity ID (issuer), IdP Signing Certificate, Import Metadata | The identity and signing certificate of the trusted IdP |
| Same form (OAuth2, OpenID Connect) | OAuth Provider (built-in catalog or Custom Provider), Client ID, Client Secret | The trusted provider and TR7's registration there |
| Same form | Custom User Attribute Mapping | Mapping the claims and attributes sent by the IdP to the AGS user fields |
| AGS-enabled vService → Flowchart | Gateway Mode = Portal application; Trusted Portals | A similar trust relationship within TR7: the application vService takes the identity from the portal vService it trusts |
Common Misconceptions
- "For federation, the users must also have an account in TR7." The identity is kept at the external IdP; AGS trusts the verification and writes the user information to the session. When a local account is needed, the Local Database type is used separately.
- "Identity federation and SSO are the same thing." Federation is a trust relationship between parties; SSO is logging in once and accessing multiple applications. SSO is mostly built on federation (What is SSO (Single Sign-On)?).
- "Once the trust is established, it needs no maintenance." When the IdP certificate, the client secret or the endpoints change, the provider profile in TR7 is also updated.
How it is done in the documentation
