Protect Applications

Securing applications is the core of Access Gateway.

Applications are deployed using an architecture similar to that shown in the following Access Gateway application architecture diagram.

In general, Access Gateway:

  • Acts as a reverse-proxy
  • Integrates with on-premises application using legacy patterns.
  • Has individual SAML contracts and authorization policies for each on-premises application.
  • Applications have their own SAML encryption, assertion attributes, session timeouts, MFA policies, and URL authorization.

Each application protected by Access Gateway is configured individually according to its specific needs and requirements.

When creating an application configuration in Access Gateway, there are various application templates available to speed the configuration process. Each application template is geared towards a specific set of application requirements. See Access Gateway supported applications for a list of all supported application types and Supported technologies for a list of all currently supported application versions.

Add sample header application

There are many sample applications, in this guide we integrate an example header application.

The header app helps you familiarize yourself with how Access Gateway works as well as providing a testing endpoint in case you need to troubleshoot application integration.

Before you begin

Ensure that:

A best practice for testing a header application is to add header.<yourdomain> to the /etc/hosts for testing purposes. On Windows, you can find this file in c:\windows\system32\drivers\etc\hosts.
This entry should point to the same IP address as uses for Access Gateway. For example:

. . . 
10.0.0.1 admin
10.0.0.1 header.myExampleDomain.com
. . .

Create example header application

  1. Open the Access Gateway Admin UI console.

    Access Gateway creates a default self-signed certificate. This is appropriate for non-production deployments. Proceed past any security exceptions raised by your browser. For production deployments, you can install a valid certificate and these exceptions aren't not needed.

  2. Click the Applications tab

    .Select applications tab
  3. Click Add to add a new application.
    Click Add.

  4. Select Header Based from the application menu, and click Create.

    Select header based and click create.

    The New Protected Application wizard starts and displays the Essentials pane for the application being added.

  5. In the Essentials pane specify the following:

    Field Value
    Label A name for the application.
    For example: Example Header Application
    Public Domain A fully qualified host name such as header.<your domain>.
    For testing, add header.<yourdomain> to /etc/hosts.
    Protected Web Resource The URL of the protected resources.
    For testing, enter http://header.service.spgw.

    Specifying a protected web resource of header.server.spgw tells Access Gateway to execute the header test suite when executed.
    Group Enter the group containing the users who should have access to the application.
    For testing this is typically the Everyone group.
    Description Optional. An appropriate description for your application.

  6. Review the Settings tab, then click Done.

    For more information on the application setting options, see Configure advanced app settings.

Complete the header application configuration

  1. Return to the Access Gateway Admin UI console.

  2. Select the new application and click the pencil icon.

    add-sample-header-app-okta.06

  3. In the Attributes section, click the +.

    add-sample-header-app-okta.07

  4. Scroll to the Add new Session Attribute window.

  5. In the Name field, enter manager.

  6. For the Value field, select the attribute type as manager.

  7. Click Okay.

    add-sample-header-app-okta.08

    In the Value menu, type in the name of the attribute you want to add, and then click the new attribute in the drop-down box.

  8. Click Done.
  9. Confirm that the Header App is displayed as Active in the Protected Applications list.

Test example header application

  1. In the row containing the application, click the Goto application > SP Initiated.
  2. On the Application page, review and verify that the Header App sent to Okta matches your profile information.
    Sample header app test