--- title: "Identity providers" slug: "identity-providers-v6-5" description: "Configure authentication services with Identity Providers (IdPs) for secure sign-in, device registration, and access control." updated: 2025-10-31T18:26:03Z published: 2025-10-31T18:25:52Z canonical: "support.appgate.com/identity-providers-v6-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Identity providers Authentication services are configured using Identity Providers. Each IdP includes configurations for device registration, Client settings, IP tunnelling pools, etc that will be applied at sign-in. The system supports authentication using external LDAP (AD), LDAP certificate, OIDC, RADIUS, and SAML identity providers (IdPs). These include standard enterprise IdPs such as Active Directory (AD). These can be used to authenticate users connecting through the client or Portal, headless clients, administrators, and for REST API calls. The password [user interaction](/v1/docs/applying-access-controls-user-interactions) also uses the IdP to (re)authenticate the user when the access controls set in an Entitlement requires it. When configuring a user interaction it is possible to specify a different IdP than the one used at authentication time. When a SAML/OIDC provider is specified for this purpose, the authentication request could be issued via the browser which makes it is possible to utilize [IdPs as an MFA provider](/v1/docs/claim-harvesting-multi-factor-authentication) in the Appgate SDP system. ## Before you start Information you will need: - Directory server connection details, certificate (for mTLS) and any search domain parameters - DNS server IP addresses that the Client will use to resolve host names Pre-configure the following elements: - IP pools: pre-configure each IP pool that you will associate with an identity provider directory. Refer to [IP Pools](/v1/docs/ip-pools) for more information - Upload device Claims scripts: for customized on-demand device claims: refer to [Device Claims Scripts](/v1/docs/device-claim-scripts) - MFA provider: if you intend to mandate this then you must configure an [MFA provider](/v1/docs/mfa-providers) - Trusted certificates: the directory server's certificate should be added to [Trusted Certificates](/v1/docs/trusted-certificates) - User directory/IdP configuration: if you intend to use anything other than the [Local user database](/v1/docs/local-user-database): - LDAP/AD: your server must support simple authentication, and it is strongly recommended that the server is configured for encrypted communication (i.e., SSL) - OIDC: configure your OIDC IdP first. For more information refer to [OIDC Identity Providers](/v1/docs/oidc-identity-providers) - SAML: configure your SAML IdP first. For more information refer to [SAML Identity Providers](/v1/docs/saml-identity-providers) Background reading: - Claims and database attributes, refer to: [Mapping user claims](/v1/docs/user-claims) - On-demand claims, refer to: [On-demand Claims](/v1/docs/claims-in-detail) - Use of [DNS and name resolvers](/v1/docs/dns-and-name-resolution-2) - For full details on all the different Identity Providers, refer to: [Identity Providers](/v1/docs/authentication-services) ### Use the Identity providers form to: - [Add new](/v1/docs/specific-settings) LDAP, LDAP Certificate, OIDC, RADIUS or SAML identity providers [IdPs] - [Edit the built-in](/v1/docs/built-in-idp-settings) Connector, local or service IdPs - Configure Appgate SDP options which are linked to IdPs such as: IP Pools, MFA at sign-in, etc - Performing actions using the action buttons provided (See below). ## Action Buttons Action buttons are accessed by clicking the three dots to the right of each line item in the table or from the button within the item. They are contextual, changing depending on the type of item and the state of the item. - ***Test User.*** Once configured, it may be possible to test a user against the IdP if there is a shown. This option allows you to enter a user name (and password) and test whether the user can be authenticated against the IdP This is only possible for IdPs that do not require some form of user interaction. If Appgate SDP can successfully bind to the directory, and the user name is valid then the test will provide a list showing how the attributes map to the user-claims and the claim values that will be returned to the Controller. The test connection button will test the connections to ALL the servers specified. It will fail if ANY of the servers are unreachable. > [!NOTE] > NOTE > > Users may still be able to sign-in as the system is designed to fail-over to the next server if any one is unreachable. ![User authentication test results showing mapped attributes and success message.](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/image(30).png?sv=2026-02-06&spr=https&st=2026-10-29T11%3A18%3A27Z&se=2026-10-29T12%3A18%3A27Z&sr=c&sp=r&sig=EPFd2UmlQwWYEQn8H5zKVIkwQcVpdQ68hnTrPgfOfUg%3D) A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system. Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model. Key-value pairs related to the identity and content of the user or device and are specific to each session. A component that extends connectivity to remote sites and unmanaged resources without requiring the use of a standalone Client. The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.