# Onsite identity - Link: https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/onsite-identity/ - Published: 2026-08-24T01:47:18+00:00 - Author: Don Bowman 1. [Home](https://www.agilicus.com/) 2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/) 3. [Authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/) 4. Onsite identity ![ca24985b-featured-anyx-admin-authenticationonsite-identity](https://www.agilicus. com/www/ca24985b-featured-anyx-admin-authenticationonsite-identity.png) ## Onsite identity [CONTACT](https://www.agilicus.com/contact-us/) The **Onsite Identity** page (route `/onsite-identity`) exposes an identity provider that runs on your own network through an Agilicus connector. Users authenticate against your own directory, and their credentials never leave your site. ![Onsite identity overview](https://www.agilicus.com/www/90ebf6c4-onsite-identity- overview.png) ## Purpose Onsite identity lets you federate an identity provider you operate yourself, for example Active Directory Federation Services or a local authentication service that runs beside an installed connector. The connector performs the authentication locally and returns a verified identity to the platform, so user credentials are handled inside your network rather than in the cloud. Each onsite provider appears as a row in the table and becomes a sign-in option on your organisation’s issuer page. The page covers the whole lifecycle: adding a provider bound to a connector, editing its properties, and deleting it. ## Why use it * Keep user credentials inside your network for compliance or security reasons. * Authenticate users against an existing on-premise directory without moving identities to the cloud. * Use the connectors you have already installed as the trust boundary for authentication. ## When to use it * When your organisation requires that user credentials never leave the corporate network. * When you already run Active Directory Federation Services or a similar on-premise identity provider. * When a connector is already deployed at the site that hosts your directory. **Prerequisite**: permission to administer issuers (an owner or administrator role), plus at least one installed connector (see [Connectors](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/)). The page shows a _no permissions_ message otherwise. ## How to use it 1. Open **Authentication > Onsite Identity** from the left navigation. 2. The table lists your onsite providers. Select **ADD PROVIDER** to add one. ![Add provider, step 1: choose provider](https://www.agilicus.com/www/c51eeae2-onsite- identity-add-step1.png) 1. The **Choose Provider** step is pre-set to **Onsite Connector**. Select **Next**. 1. In **Define Provider**, enter a **Name** for the provider, an optional **Icon** identifier, and select the **Connector** that hosts the authentication service. ![Select a connector](https://www.agilicus.com/www/0b7bf4b7-onsite-identity-connector- select.png) 1. Set the **Auto-create Status** (Default, active, pending, or disabled) and, optionally, an **Upstream Domain Name** that the connector should accept. ![Define the provider](https://www.agilicus.com/www/36a79de2-onsite-identity-define- provider.png) 1. Select **Next** to review, then **Add** on the **Apply** step to save the provider. ![Apply the provider](https://www.agilicus.com/www/56c136cc-onsite-identity-apply. png) 1. The **Done** step confirms the provider was saved. ![Provider saved](https://www.agilicus.com/www/5863475f-onsite-identity-done.png) The new provider appears in the table. ![Provider in the table](https://www.agilicus.com/www/1bba212a-onsite-identity-after- add.png) To delete providers, tick their checkboxes and select **DELETE PROVIDERS**. A notification confirms the issuer update. ![Delete notification](https://www.agilicus.com/www/36a79de2-onsite-identity-delete- notification.png) ## Fields and controls reference ### Table columns | Column | Purpose | Editable | Notes | | Name | The provider’s display name on the sign-in page | Yes | Required; up to 100 characters | | Icon | The icon identifier used on the sign-in page | Yes | | | Upstream domain name | The domain the connector accepts as its identity source | Yes | Optional; validated as a domain name | | Auto Create | Whether users are created automatically on first sign-in | Yes | Default, active, pending, or disabled | | Connector | The connector that hosts the authentication service | Yes | Selected when the provider is created | | Actions | Row menu, including Configure Group Mappings | n/a | | ### Buttons | Control | Purpose | | ADD PROVIDER | Opens the add-provider wizard | | DELETE PROVIDERS | Deletes the ticked providers | ## Dialogs and popups ### Upstream provider setup (Add provider) The **Certificates & Secrets** dialog has four steps for an onsite provider: **Choose Provider** (pre-set to Onsite Connector), **Define Provider**, **Apply**, and ** Done**. The **Define Provider** step holds the provider name, icon, connector selection, auto-create status, and upstream domain name. ### Upstream group mappings The row action **Configure Group Mappings** opens the group mappings dialog, which maps groups that arrive from the onsite provider to portal groups (see [Custom Identity](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/custom-identity/#upstream-group-mappings) for the full field reference). ## Configuration versus diagnostics versus confirmation * **Configuration**: adding, editing, and deleting onsite providers, and their group mappings. * **Diagnostics**: the table is an inventory. Connector health is visible on the [Connectors](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) pages, and sign-in attempts are in the [authentication audit](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/). * **Confirmation**: **DELETE PROVIDERS** removes the ticked providers immediately. Users who only sign in through that provider will be unable to authenticate. ## Pagination and async behaviour * The table pages at **25 rows per page**. Use the paginator to move through larger lists. * Changes save asynchronously: after creating or deleting a provider, wait a few seconds and reload to confirm. The connector’s local authentication service must be reachable for the provider to work. ## Troubleshooting * **The connector list is empty**: you need an installed connector before you can create an onsite provider. Install one under [Connectors](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) and return to this screen. * **Users cannot sign in through the provider**: confirm the connector is running and reachable, and that the upstream domain name (if set) matches your directory domain. Check the [authentication audit](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/) for failures. * **Group mappings do not apply**: confirm the input group names exactly match what the provider sends, and that the output groups exist in the portal (see [Groups](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/access/groups/)). ## See also * [Identity and authentication](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/identity-and-authentication/) * [Authentication overview](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/overview/) * [Custom identity](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/custom-identity/) * [Application identity](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/authentication/application-identity/) * [Connectors](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) * [Getting started: identify users](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/identify-users/) ## Web guide * [When should I use an onsite identity?](https://www.agilicus.com/when-should-i-use-an-onsite-identity) * [Onsite identity](https://www.agilicus.com/product-guide/onsite-identity) * [Connector sign-in](https://www.agilicus.com/product-guide/connector-sign-in)