Authentication

Authentication is the group that collects the profiles of the steps in which the identity of the user is verified in the AGS access flow. In the AGS tab in the Configuration Menu this group contains four screens; the left menu lists the screens in the order they are in the interface.

The screens complement one another: how the verification will be done is defined in the provider profile on the Authentication Providers screen; the addresses and the connection settings of the servers to which the LDAP, HTTP and RADIUS providers connect are kept in the Authentication Servers record; for the scenarios in which there is no external directory the user accounts are managed on the Local Databases screen; and the second factor verification is added to the flow with the Multi-Factor Authentication (MFA) profile.

4

Screens

In the order in the Authentication group in the interface

9

Provider types

OAuth2 · OpenID Connect · SAML 2.0 · LDAP · HTTP · Local Database · RADIUS · Portal · Web Form

5

Server protocol

LDAP · LDAPS · RADIUS · HTTP · HTTPS; multiple addresses and load distribution

3

MFA method

Email OTP · TOTP · HTTP OTP; the built-in TOTP Standard, TOTP Strict and Email OTP profiles

How do the screens work together?

1. The source against which the users will be verified is determined: for a corporate directory or for RADIUS first a server record is created on the Authentication Servers screen, and for the accounts that will be kept on TR7 a database and users are created on the Local Databases screen; the OAuth2/OIDC and SAML providers do not require a server record.
2. A provider profile of the appropriate type is defined on the Authentication Providers screen and it is bound to the server or database record; the user attribute mapping and the lockout behavior are set here.
3. If a second factor is necessary, a profile is created on the Multi-Factor Authentication (MFA) screen or one of the built-in profiles is selected.
4. The profiles are added to the access flow of the AGS-enabled vService as the Authentication provider and MFA steps; the success / fail transitions of the steps determine the continuation of the flow.

Screens

Authentication Providers

The profile of the verification step: the OAuth2, OpenID Connect, SAML 2.0, LDAP, HTTP, Local Database, RADIUS, Portal and Web Form types; 14 built-in OAuth providers, the user attribute mapping, the lockout behavior, the LDAP connection test, the OIDC discovery and SAML metadata importing.

→

Authentication Servers

The connection records of the LDAP, LDAPS, RADIUS, HTTP and HTTPS servers: the addresses and the ports, the load distribution method, the route table, the TLS validation, the timeout and the connection pool; the LDAP connection test.

→

Local Databases

The user accounts kept on TR7: the password policy per database (the length, the complexity, the reuse block) and the self-service password operations; the account fields, the groups and the custom attributes in the Users tab.

→

Multi-Factor Authentication (MFA)

The second factor profiles: Email OTP, TOTP (an authenticator application) and HTTP OTP (SMS/e-mail/a custom service); the code and time settings, the backup codes, the trusted device; the built-in TOTP Standard, TOTP Strict and Email OTP profiles.

→

Usage Locations

Screen	Where it is used
Authentication Providers	The Authentication provider step of the AGS-enabled vService flow; for the Portal type the vService in portal mode
Authentication Servers	The Authentication server field of the Authentication Providers form (the LDAP, HTTP and RADIUS types)
Local Databases	The User database field of the Authentication Providers form (the Local Database type); password resetting and changing on the access pages
Multi-Factor Authentication (MFA)	The MFA step of the AGS-enabled vService flow; the TOTP records in the TOTP tab of the vService