Access the proxies with device authorization

Terminal Proxy and RDP Proxy ask you to approve the sign-in with your organization's identity provider when your administrator enables device authorization. You approve it on a phone or another computer.

Device authorization also works on Segura™ SaaS and with Proxy 2.0.

Segura™ does not ask for its MFA token when you sign in this way. If your administrator requires an MFA token to start sessions, you still enter it.

Requirements

An administrator has enabled device authorization on an OpenID provider. See Manage OpenID providers.
Your Segura™ username matches the identity provider claim set by your administrator.
A phone or computer with a browser, where you can sign in to the identity provider.

Sign in to Terminal Proxy

In your SSH client, connect to the Terminal Proxy address with your Segura™ username.
When the Segura Terminal Proxy message appears, open the link on any device, or scan the QR code. The link is under 1. On your computer or mobile device, go to:.
If the identity provider page asks for a code, enter the code shown under 2. Enter the following code:.
Sign in to the identity provider and approve the sign-in.
In the SSH client, press Enter.

The session opens after the identity provider confirms the approval.

Sign in to RDP Proxy

In your Remote Desktop client, connect to the RDP Proxy address with your Segura™ username.
On the External Authentication screen, open the link on any device, or scan the QR code. To open the link on the same computer, click Copy URL and paste it in a browser.
If the identity provider page asks for a code, enter the code shown under 2. Enter the following code:.
Sign in to the identity provider and approve the sign-in.

The RDP Proxy screen continues after the identity provider confirms the approval. To stop, click Cancel.

Sign in to Database Proxy

Database Proxy does not use device authorization. A database client can only send a password to the server, so there is no link, code, or QR code to approve.

If you sign in to Segura™ through your identity provider and have no local password, use a temporary token as the password:

Generate a temporary token. See How to generate a temporary token for proxy access.
In your database client, configure the connection to Segura™, not directly to the database:
- Host: the Segura™ address.
- Port: the Database Proxy port for your database type. See How to modify Database Proxy port number.
- Database: the name of the target database.
- User name: vault_username[credential_username@device_hostname{database_port}]. For an example with DBeaver, see How to configure and start a PostgreSQL session with DBeaver.
- Password: the temporary token.
Connect.

Use TLS for the connection when your database client supports it, so the token does not travel in clear text. For details, see How to access Database Proxy with a temporary token.

If the sign-in fails

The sign-in fails when:

The code expires before you approve it.
You deny the sign-in.
Your identity provider account does not match your Segura™ user.

Terminal Proxy shows Invalid username or password and closes the connection. Start a new connection to get a new code.