# Applications (https://docs.idra.zone/docs/admin/applications)

Add apps from the catalog, assign them, and choose how people sign in.

Apps live under **Applications**. Each app has the tabs **General**, **Sign On**, **Assignments**, **Provisioning** and **Authentication**.

## Add an app

- **Browse App Integration Catalog** has SAML presets for Slack, GitHub Enterprise Cloud, Google Workspace, AWS IAM Identity Center, Salesforce, Zoom, Atlassian Cloud, Notion, Figma and Dropbox, plus the generic types below. A SCIM badge on a preset means the vendor offers SCIM: set up [provisioning](https://docs.idra.zone/docs/admin/scim) yourself, because the preset doesn't configure it.
- **Create App Integration** creates a generic app. Pick the sign-in method:

| Sign-in method | Use it for |
| --- | --- |
| **OIDC - OpenID Connect** | Modern web apps, single-page apps and APIs. See [OIDC](https://docs.idra.zone/docs/admin/oidc). |
| **SAML 2.0** | Enterprise SaaS. See [SAML](https://docs.idra.zone/docs/admin/saml). |
| **Bookmark** | A tile on My Apps that opens a URL. No sign-on settings. |
| **Access Gateway** | Legacy apps that only understand HTTP headers, behind your reverse proxy. |

## Assignments

On **Assignments**, assign people or groups. Only assigned people see the app on My Apps and can sign in to it. Assigning a group (including **Everyone**) covers its current and future members.

Every way into an app (OIDC, SAML, the gateway, launching from My Apps) checks the same three things: the person is assigned, the request isn't from a blocked network zone, and the app's [authentication policy](https://docs.idra.zone/docs/admin/policies) allows it, possibly after a step-up.

## Access Gateway

An Access Gateway app puts IdRa in front of an app that has no SSO support. Your reverse proxy calls IdRa's forward-auth endpoint, `GET /gateway/auth`, on each request:

- **200** with identity headers when the person is signed in, assigned and allowed;
- a redirect to sign in or to verify again;
- **403** when they're not allowed.

Configure the **Public host**, the **Upstream** and the **Identity headers** (defaults `X-Remote-User`, `X-Email`, `X-Groups`; values are templates such as `{email}` or `{profile.department}`). The Sign On tab shows a ready-to-use Caddy `forward_auth` snippet; Traefik ForwardAuth and nginx `auth_request` (add `?mode=nginx`) work too.

  Gateway apps must be on a subdomain of the session cookie's domain (`COOKIE_DOMAIN`, or the
  tenant's Access Gateway cookie domain under **Customizations → Domains**). Upstreams receive the IdRa
  session cookie, so only put trusted apps behind the gateway.