SSOGEN glossary: SSO terminology

Terms are in alphabetical order inside each group. Names in bold are the labels you see in the console. Examples use the fictional company Acme Corp (acme.example).

People and sign-in

Assurance level (sign-in strength). How strongly SSOGEN is sure of who you are. The console shows three levels:

• Single-factor (also written “password or single sign-on”): one proof, such as a password. Whatever the identity provider did is accepted.
• Multi-factor (“plus a second factor”): a second proof is required. SSOGEN asks for one if the identity provider did not.
• Phishing-resistant (“passkey or security key”): only a passkey or a security key is accepted.

A policy states the level it requires. After you sign in, Sessions in My Account shows the level each session reached.

Authenticator app. A phone app that shows a 6-digit code that changes every 30 seconds. SSOGEN’s own app is the SSOGEN Authenticator, which also approves sign-ins (see Phone approval). See TOTP.

Directory. A source of people that you connect to SSOGEN, usually LDAP or Microsoft Active Directory, so people sign in with the account they already have. In the console, Directories are listed under Identity. Do not confuse it with Users, which is the list of people SSOGEN knows.

Group. A named set of people. You give applications to groups instead of to each person. SSOGEN creates one group itself, Everyone.

Identity provider (IdP). Anything that can check who a person is. SSOGEN’s own usernames and passwords (the built-in local-db provider), your LDAP or Active Directory, and services that speak SAML or OpenID Connect (Microsoft Entra ID, Okta, Keycloak) are all identity providers. See Identity providers under SSO policies.

Linked identity. A sign-in method on another provider that is tied to one SSOGEN user. Shown in My Account under Linked identities.

LDAP. A standard way for programs to read a company directory. Active Directory supports it.

Multi-factor authentication (MFA). Signing in with more than one kind of proof, for example a password and a code from your phone. Also called a second factor or second step.

OpenID Connect (OIDC). A standard way for an application to ask an identity provider who a person is. SSOGEN can use an OIDC service to sign people in, and can act as the OIDC provider for your applications.

Number matching. Approving a sign-in on your phone by tapping, among six numbers, the one the sign-in page shows. It proves the person holding the phone is the person at the sign-in page.

Passkey. Signing in with the device you already unlock (a phone, a laptop, a security key) instead of a password. Nothing is typed, so nothing can be phished or reused.

Phone approval. Approving a sign-in on the paired SSOGEN Authenticator instead of typing a code. Optionally it can also replace the password (Sign in with your phone, set in a policy).

Recovery code. A one-time code that signs you in if you lose your other methods. Each works once. Generated in My Account under Authenticator, in the Recovery codes section.

SAML. A standard way for an application to receive a signed statement from an identity provider that a person has signed in. SSOGEN can use a SAML service to sign people in, and can act as the SAML provider for your applications.

Second factor / second step. The extra proof after the password. SSOGEN accepts, depending on policy: an authenticator app, a recovery code, a code sent by text message, or a code sent by email. Text and email codes are weaker because they can be intercepted.

Session. The period during which you stay signed in. By default it ends after 30 minutes without use, or 12 hours in total. Administrators can change both under Settings, Security.

Single sign-on (SSO). Signing in once and opening many applications without signing in to each.

Step-up. Being asked for more proof in the middle of a session because an application needs a higher assurance level than you have so far shown, for example a second factor.

TOTP. “Time-based one-time password”: the standard behind authenticator apps. Any TOTP app works with SSOGEN.

User. A person SSOGEN knows. Each has a username, sign-in methods, group memberships and application access.

Policy and administration

Access rule. A rule that decides what a signed-in person may reach, across every application. The first rule that matches decides. Anything no rule allows is denied. Access rules are on the Defaults page under SSO policies.

Admin mode (elevation). A short-lived state in which an administrator may use administrator powers. The console enters it by itself when the administrator’s sign-in meets the console’s sign-in policy, the only rule for opening the console. It ends after 15 minutes without use, or 60 minutes in total, by default.

Administrator role. What an administrator may see and do. The six built-in roles are Super admin, Authentication admin, Application admin, Directory admin, Security audit reader and Read-only admin. See the Admin Console tour.

Agent key. The key one application’s Web Agent or Java agent uses to prove which application it serves. Generated on the application’s Integration tab, shown once, stored by SSOGEN only as a hash, and replaced by generating a new one.

Audit log. The record of what happened and who did it, read under Monitoring, Audit. SSOGEN checks that the log has not been altered and shows the result as Audit integrity.

Authentication policy (policy). A named rule that many applications share: which identity providers may be used, how much strength (assurance level) is required, which second-step methods are accepted, and what happens when a session does not have enough. Editing a policy reaches every application that uses it. See Policies under SSO policies.

Branding. Your company name, logo, colors, heading and links on the sign-in pages. Under Settings, Branding.

Canonical origin. The one web address people use to reach SSOGEN, for example https://sso.acme.example. It is set at install time, cannot be changed afterward, and SSOGEN refuses requests that arrive through any other address.

Default policy. The authentication policy that applies to every application that has no policy of its own, and to signing in at My Apps. Set on the Defaults page.

Network zone. A named group of network addresses, such as “corporate”. Policies and access rules can say that a sign-in is allowed only from inside a zone, or denied from outside every zone. Administrators add and edit zones under SSO policies, Network zones; zones from the installation’s settings are listed there too and cannot be changed in the console. Unless changed, one zone called corporate covers the standard private address ranges (RFC 1918). An address that proves no network, such as a connection from loopback, is in no zone.

Organization (realm). Your organization’s own space in SSOGEN: its people, groups, identity providers, applications, policies, settings and audit log. It has one canonical origin.

Secret. A credential SSOGEN uses to reach another system, such as a directory password or a provisioning token. Stored encrypted and never shown again after you save it. See Settings, Secrets.

Signing key. The key SSOGEN uses to sign the sign-in messages it sends to applications, so they can trust them. See Settings, Certificates.

Webhook. A way to send SSOGEN’s events to another system as they happen. See Monitoring, Webhooks.

What if. A page that answers “what would happen if this person opened this application now, and which rule decided it” without changing anything.

Applications and provisioning

App Pack. A signed, ready-made definition for a well-known application. Only a pack whose signature checks out is installed. Listed on the App Packs page, opened from the App Packs button on the Applications page.

Application. Something your people open through SSOGEN: a web application, a SAML or OpenID Connect application, or an internal application behind an App Proxy route. The console lists applications in four groups by how they are reached: Web Agent, SAML, OpenID Connect and App Proxy.

Assignment. Giving an application to a person or group. People see in My Apps only what they have been assigned.

My Apps. The employee page that shows assigned applications and opens them.

Provisioning. Keeping accounts in step. Inbound provisioning lets another system create and update people in SSOGEN over SCIM. Outbound provisioning creates and turns off accounts inside applications as people gain or lose access.

SCIM. A standard way for systems to exchange user accounts automatically.

Web Agent and SSOGEN Gateway

Directory Connector. An SSOGEN Gateway feature that reaches a directory on SSOGEN’s behalf, for networks SSOGEN cannot reach itself.

Outbound Connector. An SSOGEN Gateway feature: a small program in a private network that dials out to a Gateway, so the Gateway can reach applications and hosts there without any inbound port. Shown under Secure access, Outbound Connector.

Connector address. The host name and port, such as gateway.acme.example:9946, where a connector dials an SSOGEN Gateway group. Set under the group’s Connector addresses on App Proxy routes.

Reach through. The choice, on a route or a Remote Access resource, of connecting directly or through an Outbound Connector group.

Host header. The name an application is asked for. A route sends the application its own internal name (Internal, with links and cookies in the answers rewritten to the public name) or the public name unchanged (External).

Stored account. The one account SSOGEN keeps for a Remote Access resource and uses to sign people in. It is write-only: it can be replaced or removed, never read back.

Pairing. The step in which an administrator checks the key or certificate a remote host presents, compares it with the host’s own, and trusts it. People are never asked to accept one.

Relay and uplink. A relay is a server on the internet that passes encrypted connections to an SSOGEN Gateway that dials out to it. A Gateway group’s Uplink relay setting turns that on; SSOGEN then orders and renews the certificates for the relay names automatically.

CAA record. A DNS record that says which certificate authority, and which account at it, may issue certificates for a name. The one SSOGEN shows for relay names is published by whoever runs the relay.

Enrollment string. One pasted text, starting ssogen-edge-enrol:, shown once beside an enrollment token. It lets a Gateway enroll without a trust bundle download.

SSOGEN Gateway group. A set of SSOGEN Gateway instances that serve the same routes. SSOGEN publishes routes to an SSOGEN Gateway group, and each instance in the group fetches them. Listed under Secure access, Gateways.

SSOGEN Gateway instance. One running SSOGEN Gateway program, which reports in to SSOGEN. Several instances can belong to one SSOGEN Gateway group.

App Proxy. An SSOGEN Gateway feature that gives people secure access to internal applications that are not exposed to the internet. People sign in through SSOGEN first.

Hostname. A public name the App Proxy answers to, for example payroll.acme.example. It is served with a certificate and governed by a sign-in policy.

Listener. Where an SSOGEN Gateway group accepts connections, either directly from browsers or from a load balancer.

Remote Access. An SSOGEN Gateway feature that lets an authorized person reach a host through the browser over SSH, RDP or VNC.

Route. The rule that connects a public hostname to an internal application: when a visitor asks for this name, send them, after sign-in, to that back-end server. Routes are edited under Secure access, App Proxy routes and published to the SSOGEN Gateway group.

SSOGEN Gateway. The program you run inside your network. Its features are App Proxy, Remote Access, Outbound Connector and Directory Connector.

SSOGEN Web Agent. The module installed in an Apache web server in front of an application. It checks each request against SSOGEN and lets the application know who signed in.

Workload certificate authority. The certificate authority SSOGEN runs to issue certificates to machines such as Gateways. The installer creates it; you do not manage it.

AI agents

AI agent (non-human identity). An AI agent, MCP client, automation or service that calls your applications. Each is registered with an owner and an expiry. Managed under AI agents.

Approval (AI agents). A human approval of a sensitive permission an AI agent asks to use on a person’s behalf. Listed under AI agents, Approvals; the person decides under Approvals in My Apps.

Delegation. What a person has allowed an AI agent to do for them. The person can withdraw it at any time in My Account, under AI agents.

Kill switch. A control that stops every non-human identity of one type at once.

MCP server. An application that AI agents reach using the Model Context Protocol.

Related guides

Start with what SSOGEN is, take the Admin Console tour and read how sign-in decisions work.