Onsite identity

The Onsite Identity page (route /onsite-identity) exposes an identity provider that runs on your own network through an Agilicus connector. Users authenticate against your own directory, and their credentials never leave your site.

Purpose

Onsite identity lets you federate an identity provider you operate yourself, for example Active Directory Federation Services or a local authentication service that runs beside an installed connector. The connector performs the authentication locally and returns a verified identity to the platform, so user credentials are handled inside your network rather than in the cloud.

Each onsite provider appears as a row in the table and becomes a sign-in option on your organisation’s issuer page. The page covers the whole lifecycle: adding a provider bound to a connector, editing its properties, and deleting it.

Why use it

Keep user credentials inside your network for compliance or security reasons.
Authenticate users against an existing on-premise directory without moving identities to the cloud.
Use the connectors you have already installed as the trust boundary for authentication.

When to use it

When your organisation requires that user credentials never leave the corporate network.
When you already run Active Directory Federation Services or a similar on-premise identity provider.
When a connector is already deployed at the site that hosts your directory.

Prerequisite: permission to administer issuers (an owner or administrator role), plus at least one installed connector (see Connectors). The page shows a no permissions message otherwise.

How to use it

Open Authentication > Onsite Identity from the left navigation.
The table lists your onsite providers. Select ADD PROVIDER to add one.

The Choose Provider step is pre-set to Onsite Connector. Select Next.

In Define Provider, enter a Name for the provider, an optional Icon identifier, and select the Connector that hosts the authentication service.

Set the Auto-create Status (Default, active, pending, or disabled) and, optionally, an Upstream Domain Name that the connector should accept.

Select Next to review, then Add on the Apply step to save the provider.

The Done step confirms the provider was saved.

The new provider appears in the table.

To delete providers, tick their checkboxes and select DELETE PROVIDERS. A notification confirms the issuer update.

Fields and controls reference

Table columns

Column	Purpose	Editable	Notes
Name	The provider’s display name on the sign-in page	Yes	Required; up to 100 characters
Icon	The icon identifier used on the sign-in page	Yes
Upstream domain name	The domain the connector accepts as its identity source	Yes	Optional; validated as a domain name
Auto Create	Whether users are created automatically on first sign-in	Yes	Default, active, pending, or disabled
Connector	The connector that hosts the authentication service	Yes	Selected when the provider is created
Actions	Row menu, including Configure Group Mappings	n/a

Buttons

Control	Purpose
ADD PROVIDER	Opens the add-provider wizard
DELETE PROVIDERS	Deletes the ticked providers

Dialogs and popups

Upstream provider setup (Add provider)

The Certificates & Secrets dialog has four steps for an onsite provider: Choose Provider (pre-set to Onsite Connector), Define Provider, Apply, and Done. The Define Provider step holds the provider name, icon, connector selection, auto-create status, and upstream domain name.

Upstream group mappings

The row action Configure Group Mappings opens the group mappings dialog, which maps groups that arrive from the onsite provider to portal groups (see Custom Identity for the full field reference).

Configuration versus diagnostics versus confirmation

Configuration: adding, editing, and deleting onsite providers, and their group mappings.
Diagnostics: the table is an inventory. Connector health is visible on the Connectors pages, and sign-in attempts are in the authentication audit.
Confirmation: DELETE PROVIDERS removes the ticked providers immediately. Users who only sign in through that provider will be unable to authenticate.

Pagination and async behaviour

The table pages at 25 rows per page. Use the paginator to move through larger lists.
Changes save asynchronously: after creating or deleting a provider, wait a few seconds and reload to confirm. The connector’s local authentication service must be reachable for the provider to work.

Troubleshooting

The connector list is empty: you need an installed connector before you can create an onsite provider. Install one under Connectors and return to this screen.
Users cannot sign in through the provider: confirm the connector is running and reachable, and that the upstream domain name (if set) matches your directory domain. Check the authentication audit for failures.
Group mappings do not apply: confirm the input group names exactly match what the provider sends, and that the output groups exist in the portal (see Groups).