Changing the Authentication Proxy Service

If you have multiple reverse proxies, you can select the reverse proxy that users are redirected to for login and logout.

IMPORTANT:Changing the reverse proxy that is used for authentication is not a trivial task. For example, if you have customized the logout options on your web servers to redirect the logout request to the Logout URL of the current authentication reverse proxy, you need to modify these options to point to a new Logout URL.

If you have set up SSL connections, you need to change your certificate configurations.

To select the reverse proxy to use for authentication:

  1. Click Devices > Access Gateways > Reverse Proxy / Authentication.

  2. In the Embedded Service Provider section, select a value for the Reverse Proxy option. This is the reverse proxy that is used for authentication.

    The screen is refreshed and the Metadata URL, Health-Check URL, and Logout URL are rewritten to use the selected reverse proxy.

  3. (Conditional) If your Access Gateway certificates were generated by a different certificate authority than your Identity Server certificates, you need to import the trusted root of Identity Server into the trusted root keystore of the Embedded Service Provider. Click Auto-Import Identity Server Configuration Trusted Root, click OK, specify an alias, click OK, then click Close.

    If you don’t know whether you need to import the trusted root, click the option. If the trusted root is already in the keystore, the duplicate key is not imported and you are informed of this condition.

  4. In the Reverse Proxy List, click the name of the reverse proxy that you have selected for authentication.

  5. If you have enabled SSL between the Embedded Service Provider and Identity Server, you need to import the trusted root of the Embedded Service Provider into the trusted root keystore of Identity Server. Click Auto-Import Embedded Service Provider Trusted Root, click OK, specify an alias, click OK, then click Close.

    If you don’t know whether you need to import the trusted root, click the option. If the trusted root is already in the keystore, the duplicate key is not imported and you are informed of this condition.

  6. If you have enabled SSL between the browser and Access Gateway, you need to configure this reverse proxy for SSL. Use the Select Certificate icon to browse for the certificate that matches the DNS name of the proxy service or use the Auto-generate Key option to create a certificate that matches the DNS name of the proxy service.

  7. To save your changes to browser cache, click OK.

  8. To apply the changes, click the Access Gateways link, then click Update > OK.

  9. (Conditional) If you have customized web logout pages, update them to use the new Logout URL.