# Onsite identity

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/)
4. Onsite identity

![](https://www.agilicus.com/www/ca24985b-featured-anyx-admin-authenticationonsite-identity.png)## Onsite identity

[CONTACT](/contact-us/)

The **Onsite Identity** page (route `/onsite-identity`) exposes an identity provider that runs on your own network through an Agilicus connector. Users authenticate against your own directory, and their credentials never leave your site.

![Onsite identity overview](https://www.agilicus.com/www/90ebf6c4-onsite-identity-overview.png)    ## Purpose

Onsite identity lets you federate an identity provider you operate yourself, for example Active Directory Federation Services or a local authentication service that runs beside an installed connector. The connector performs the authentication locally and returns a verified identity to the platform, so user credentials are handled inside your network rather than in the cloud.

Each onsite provider appears as a row in the table and becomes a sign-in option on your organisation's issuer page. The page covers the whole lifecycle: adding a provider bound to a connector, editing its properties, and deleting it.

## Why use it

- Keep user credentials inside your network for compliance or security reasons.
- Authenticate users against an existing on-premise directory without moving identities to the cloud.
- Use the connectors you have already installed as the trust boundary for authentication.

## When to use it

- When your organisation requires that user credentials never leave the corporate network.
- When you already run Active Directory Federation Services or a similar on-premise identity provider.
- When a connector is already deployed at the site that hosts your directory.

**Prerequisite**: permission to administer issuers (an owner or administrator role), plus at least one installed connector (see [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/)). The page shows a *no permissions* message otherwise.

## How to use it

1. Open **Authentication > Onsite Identity** from the left navigation.
2. The table lists your onsite providers. Select **ADD PROVIDER** to add one.

![Add provider, step 1: choose provider](https://www.agilicus.com/www/c51eeae2-onsite-identity-add-step1.png)    1. The **Choose Provider** step is pre-set to **Onsite Connector**. Select **Next**.

1. In **Define Provider**, enter a **Name** for the provider, an optional **Icon** identifier, and select the **Connector** that hosts the authentication service.

![Select a connector](https://www.agilicus.com/www/0b7bf4b7-onsite-identity-connector-select.png)    1. Set the **Auto-create Status** (Default, active, pending, or disabled) and, optionally, an **Upstream Domain Name** that the connector should accept.

![Define the provider](https://www.agilicus.com/www/36a79de2-onsite-identity-define-provider.png)    1. Select **Next** to review, then **Add** on the **Apply** step to save the provider.

![Apply the provider](https://www.agilicus.com/www/56c136cc-onsite-identity-apply.png)    1. The **Done** step confirms the provider was saved.

![Provider saved](https://www.agilicus.com/www/5863475f-onsite-identity-done.png)    The new provider appears in the table.

![Provider in the table](https://www.agilicus.com/www/1bba212a-onsite-identity-after-add.png)    To delete providers, tick their checkboxes and select **DELETE PROVIDERS**. A notification confirms the issuer update.

![Delete notification](https://www.agilicus.com/www/36a79de2-onsite-identity-delete-notification.png)    ## Fields and controls reference

### Table columns

| Column | Purpose | Editable | Notes |
|---|---|---|---|
| Name | The provider's display name on the sign-in page | Yes | Required; up to 100 characters |
| Icon | The icon identifier used on the sign-in page | Yes |  |
| Upstream domain name | The domain the connector accepts as its identity source | Yes | Optional; validated as a domain name |
| Auto Create | Whether users are created automatically on first sign-in | Yes | Default, active, pending, or disabled |
| Connector | The connector that hosts the authentication service | Yes | Selected when the provider is created |
| Actions | Row menu, including Configure Group Mappings | n/a |  |

### Buttons

| Control | Purpose |
|---|---|
| ADD PROVIDER | Opens the add-provider wizard |
| DELETE PROVIDERS | Deletes the ticked providers |

## Dialogs and popups

### Upstream provider setup (Add provider)

The **Certificates & Secrets** dialog has four steps for an onsite provider: **Choose Provider** (pre-set to Onsite Connector), **Define Provider**, **Apply**, and **Done**. The **Define Provider** step holds the provider name, icon, connector selection, auto-create status, and upstream domain name.

### Upstream group mappings

The row action **Configure Group Mappings** opens the group mappings dialog, which maps groups that arrive from the onsite provider to portal groups (see [Custom Identity](/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/custom-identity/#upstream-group-mappings) for the full field reference).

## Configuration versus diagnostics versus confirmation

- **Configuration**: adding, editing, and deleting onsite providers, and their group mappings.
- **Diagnostics**: the table is an inventory. Connector health is visible on the [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) pages, and sign-in attempts are in the [authentication audit](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/).
- **Confirmation**: **DELETE PROVIDERS** removes the ticked providers immediately. Users who only sign in through that provider will be unable to authenticate.

## Pagination and async behaviour

- The table pages at **25 rows per page**. Use the paginator to move through larger lists.
- Changes save asynchronously: after creating or deleting a provider, wait a few seconds and reload to confirm. The connector's local authentication service must be reachable for the provider to work.

## Troubleshooting

- **The connector list is empty**: you need an installed connector before you can create an onsite provider. Install one under [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) and return to this screen.
- **Users cannot sign in through the provider**: confirm the connector is running and reachable, and that the upstream domain name (if set) matches your directory domain. Check the [authentication audit](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) for failures.
- **Group mappings do not apply**: confirm the input group names exactly match what the provider sends, and that the output groups exist in the portal (see [Groups](/anyx-guide/agilicus-anyx-administrative-web-interface/access/groups/)).

## See also

- [Identity and authentication](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/)
- [Authentication overview](/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/overview/)
- [Custom identity](/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/custom-identity/)
- [Application identity](/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/application-identity/)
- [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/)
- [Getting started: identify users](/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/identify-users/)

## Web guide

- [When should I use an onsite identity?](https://www.agilicus.com/when-should-i-use-an-onsite-identity)
- [Onsite identity](https://www.agilicus.com/product-guide/onsite-identity)
- [Connector sign-in](https://www.agilicus.com/product-guide/connector-sign-in)