SSO Server Software: What SSOGEN Is and Does

SSOGEN is SSO server software: single sign-on (SSO) and identity provider software that you install to control access to your applications. It answers three questions for your organization every time someone opens a business application:

1. Who is this person? (sign-in, including a second step such as a code from an authenticator app)
2. Are they allowed to open this application, from here, right now? (policy)
3. How do they get in without typing a password again? (single sign-on)

“Single sign-on” (SSO) means a person signs in once and then opens many applications without signing in to each one separately.

This guide introduces the parts of SSOGEN in the order you will meet them. The examples use a fictional company, Acme Corp, whose domain is acme.example.

The parts, in customer terms

Part	Who uses it	What it is
SSOGEN	Everyone, through three web pages	The server you install. It holds your people, applications and policies, and it runs the sign-in. It has three web pages: the Admin Console, My Apps and My Account.
Admin Console	Administrators	Where you set everything up and watch it run: people and groups, identity providers, policies, applications, secure access, monitoring and settings.
My Apps	Every employee	A personal page of applications. It shows the applications the person has been given and opens them with one click.
My Account	Every employee	Where a person manages their own sign-in: password, passkeys, authenticator app, recovery codes, sessions and recent security activity.
SSOGEN Web Agent	Administrators who protect applications served by Apache	A module that you install into the Apache web server in front of an application. On every request it checks that the visitor has signed in through SSOGEN and is allowed in, then passes the person’s identity to the application. It supports Apache 2.4, and Apache 2.2 including Oracle HTTP Server.
SSOGEN Gateway	Administrators who need to reach applications and hosts inside a private network	A separate program you run inside your network. It has four features, described below.
SSOGEN Authenticator	Employees	A mobile app for iPhone and iPad that shows the time-based codes for second-step sign-in. Passkeys are added in My Account. Any standard authenticator app that produces time-based codes (TOTP) also works with SSOGEN. See The SSOGEN Authenticator app.

The four SSOGEN Gateway features

The SSOGEN Gateway connects SSOGEN to networks that SSOGEN cannot, or should not, reach directly.

• App Proxy. Gives people secure access to internal applications that are not exposed to the internet. Each application has a route that says which public hostname leads to which internal server. People sign in through SSOGEN first.
• Outbound Connector. Reaches applications by connecting outward from inside your network, so those applications need no public hostname at all.
• Remote Access. Lets an authorized person reach a host through the browser over SSH, RDP or VNC, with access controlled and audited by SSOGEN.
• Directory Connector. Lets SSOGEN reach a directory (for example Active Directory) that sits in a network SSOGEN cannot reach itself. The SSOGEN Gateway reaches the directory on SSOGEN’s behalf. Today it tests a connection; sign-in does not use it yet.

SSOGEN can be hosted by SSOGEN, or run on-premises in your own environment.

You do not need an SSOGEN Gateway to start. A common first deployment is SSOGEN alone, then the Web Agent in front of one or two applications.

How they fit together

Your people: employees and contractors

• My AppsPeople open their applications
• My AccountTheir own sign-in and security
• Admin ConsoleAdministrators only

SSOGENPeople, groups, applications, policies, sign-in, sessions and the audit log

• Identity providersSSOGEN's own users, LDAP or Active Directory, SAML, OpenID ConnectWhere people's passwords live
• Web AgentIn front of ApacheYour web applications
• SSOGEN GatewayInside your network: App Proxy, Outbound Connector, Remote Access, Directory ConnectorInternal applications, hosts and directories

Read the picture from top to bottom:

1. A person opens My Apps and signs in. SSOGEN asks an identity provider to check the person. An identity provider is whatever already knows the person’s password: SSOGEN’s own user list, your LDAP or Active Directory, or another service that speaks SAML or OpenID Connect (such as Microsoft Entra ID or Keycloak).
2. SSOGEN applies the policy that belongs to the application the person wants: how strong the sign-in must be, which providers are allowed, and what to do if the person has not signed in strongly enough. It may ask for a second step.
3. SSOGEN lets the person into the application. How depends on the application. A modern application receives a standard SAML or OpenID Connect sign-in. An application behind Apache is protected by the Web Agent. An internal application is reached through an SSOGEN Gateway route.
4. Everything important is written to the audit log, which administrators read in the Admin Console under Monitoring.

The three web pages

SSOGEN serves three pages from the same address. With an SSOGEN server at https://sso.acme.example:

Page	Address	Who can open it
My Apps	https://sso.acme.example/apps/	Anyone who can sign in
My Account	https://sso.acme.example/account/	Anyone who can sign in
Admin Console	https://sso.acme.example/admin/	Only people who hold an administrator role

The top bar of each page has links to the others. The Admin link appears only for people who hold an administrator role, so employees never see a door they cannot open.

The top bar of My Apps with the My Apps, My Account and Admin links and the Sign out button

What you do first

1. Install SSOGEN and create the first administrator.
2. Take a tour of the Admin Console so you know where everything is.
3. Connect an identity provider, add people, register an application and assign it (each has its own guide).
4. Ask one employee to follow Signing in for the first time to confirm it all works end to end.

If a word in this guide is new, the glossary explains it.

A one-page list of capabilities with links: what SSOGEN does.