0613b6d6 featured anyx admin conceptsidentity and authentication

Identity and authentication

CONTACT

Agilicus AnyX lets users sign in with the identity provider they already use, instead of creating a new username and password in the platform. This is the unified authentication capability of the product and one of its key differentiators: users have no shadow accounts, and when they leave their organisation their access disappears with their identity.

Identity providers

An identity provider is the service that confirms who a user is. The portal supports several kinds:

Provider typeDescriptionWhere to configure
Shared identityA built-in provider shared across Agilicus organisations. Simplest option; no third-party registration required.Shared identity
Custom identityA provider you register yourself with a third party (for example a Google or Azure application registration), giving you full control over scopes and settings.Custom identity
Onsite identityAn identity provider you run on your own network (for example Active Directory Federation Services). User credentials never leave your site.Onsite identity
Application identityAn identity provider scoped to a single application, used when that application needs its own authentication behaviour.Application identity

You can configure more than one provider, and the authentication policy decides which providers are acceptable for which situation.

%%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%%
flowchart LR
    U[User] -->|chooses provider at sign-in| AP[Authentication policy]
    AP --> SH[Shared identity]
    AP --> CU[Custom identity]
    AP --> ON[Onsite identity]
    AP --> AI[Application identity]
    SH --> OK[Identity verified]
    CU --> OK
    ON --> OK
    AI --> OK
    OK --> MFAM[Multi-factor authentication?]
    MFAM -->|required| SEC[Second factor]
    SEC --> SES[Session established]
    MFAM -->|not required| SES

How authentication works

  1. The user opens a resource URL, which points (through your CNAME) at the Agilicus identity-aware proxy.
  2. The proxy presents the organisation’s sign-in page, themed to your organisation.
  3. The user chooses or is routed to an identity provider and authenticates there.
  4. The provider returns a verified identity to the proxy.
  5. If the authentication policy requires it, the user completes multi-factor authentication.
  6. A session is established, and the user can request access to resources.

Each step is recorded in the authentication audit, so you can see who signed in, from where, and whether the attempt succeeded.

Multi-factor authentication

Multi-factor authentication requires the user to prove their identity with more than one factor, for example a password and a one-time code from an authenticator application. Because the identity-aware proxy sits in front of every resource, multi-factor authentication applies consistently across all of them, including legacy applications that cannot implement it themselves.

You control when multi-factor authentication is required through the authentication policy (for example always, or only for specific providers or situations).

Groups and identity

The portal can map groups from your identity provider to portal groups automatically, so your existing group structure (for example from Active Directory or Google Workspace) drives permissions without duplicating administration. See Groups and Identity group mapping.

See also

Web guide