Applications
Add apps from the catalog, assign them, and choose how people sign in.
Apps live under Applications. Each app has the tabs General, Sign On, Assignments, Provisioning and Authentication.
Add an app
- Browse App Integration Catalog has SAML presets for Slack, GitHub Enterprise Cloud, Google Workspace, AWS IAM Identity Center, Salesforce, Zoom, Atlassian Cloud, Notion, Figma and Dropbox, plus the generic types below. A SCIM badge on a preset means the vendor offers SCIM: set up provisioning yourself, because the preset doesn't configure it.
- Create App Integration creates a generic app. Pick the sign-in method:
| Sign-in method | Use it for |
|---|---|
| OIDC - OpenID Connect | Modern web apps, single-page apps and APIs. See OIDC. |
| SAML 2.0 | Enterprise SaaS. See SAML. |
| Bookmark | A tile on My Apps that opens a URL. No sign-on settings. |
| Access Gateway | Legacy apps that only understand HTTP headers, behind your reverse proxy. |
Assignments
On Assignments, assign people or groups. Only assigned people see the app on My Apps and can sign in to it. Assigning a group (including Everyone) covers its current and future members.
Every way into an app (OIDC, SAML, the gateway, launching from My Apps) checks the same three things: the person is assigned, the request isn't from a blocked network zone, and the app's authentication policy allows it, possibly after a step-up.
Access Gateway
An Access Gateway app puts IdRa in front of an app that has no SSO support. Your reverse proxy calls IdRa's forward-auth endpoint, GET /gateway/auth, on each request:
- 200 with identity headers when the person is signed in, assigned and allowed;
- a redirect to sign in or to verify again;
- 403 when they're not allowed.
Configure the Public host, the Upstream and the Identity headers (defaults X-Remote-User, X-Email, X-Groups; values are templates such as {email} or {profile.department}). The Sign On tab shows a ready-to-use Caddy forward_auth snippet; Traefik ForwardAuth and nginx auth_request (add ?mode=nginx) work too.
Gateway apps must be on a subdomain of the session cookie's domain (COOKIE_DOMAIN, or the
tenant's Access Gateway cookie domain under Customizations → Domains). Upstreams receive the IdRa
session cookie, so only put trusted apps behind the gateway.