Changes
/* Important information */
Single Sign-On (SSO) allows a user to access multiple services in a single session, without having to authenticate themselves repeatedly. {{UBIK}} can be integrated into an SSO environment.
= Important information : Reverse Proxies =Single Sign-On (SSO) offers benefits beyond reusing a central account, such as ensuring only the identity provider and browser see user credentials, and enforcing two-factor authentication (2FA). Organizations often secure HTTPS interactions by ensuring requests carry a session cookie from the identity provider or redirecting requests to the identity provider.
{{Hint|It UBIK}} supports this, too, by providing the SSO bearer token within the "Authorization" header for every request. A reverse proxy can verify this token or prevent access otherwise. Unfortunately, Microsoft Entry Application Proxy - even with the helpful-sounding "header-based SSO" configuration - is necessary unable to just check this header without dropping the data when forwarding the incoming message to exclude {{UBIK}} web service URLs from . Hence, with the Microsoft Entra Application Proxy the only way is to deactivate the check. Also, any application gateway's 2FA redirect rules!method checking the session cookie is doomed to fail because for the backchannel, {{UBIK}}doesn't have any access to the browser's cookies, just to the SSO token.
If there are further questions, support is available to help.
[[Category:Mobile|Single Sign-On]][[Category:SSO|Single Sign-On]]
= Protocols =
