Authentication in an application verifies the user's identity before allowing access to resources and functionality. This process ensures security and protects sensitive information.
The term SSO (Single Sign-On) allows users to access multiple applications with a single credential, improving the experience by reducing the need to remember multiple passwords and increasing security by centralizing access management.
Anjana Data facilitates authentication by integrating with various platforms (Auth0, Okta, AWS, Azure, Google, Keycloak) via standard protocols (OIDC, SAML), corporate directories (LDAP/AD), and the local database.
Prerequisite: the user must exist in Anjana
For login to be successful, regardless of the mechanism used (OIDC, SAML, LDAP, or local database), the user must already be registered in the Anjana database. External authentication verifies the user's identity with the identity provider, but Anjana always checks that the user exists locally before granting access. If the user successfully authenticates with the IdP but is not registered in Anjana, access will be denied.
There are two ways to register users in Anjana:
-
Direct creation: the administrator manually creates the user from the Anjana administration interface.
-
Automatic provisioning: connect Anjana to the corporate directory (Azure AD, Keycloak, LDAP, Okta, etc.) using the User provisioning feature and run the synchronization, which automatically imports and keeps records up to date. This is the recommended method in environments with a centralized corporate directory.
User synchronization is independent of the authentication mechanism: users can be provisioned from Azure AD even if authentication is performed via SAML with Okta, for example.
General configuration
Before explaining each provider, the app.base-url property must be configured, setting the API host as its value, as follows:
app:
base-url: https://dev.anjanadata.org/
The configuration for each supported mechanism is detailed below.