Device authorization lets users sign in to Terminal Proxy and RDP Proxy through your OpenID identity provider. Native SSH and RDP clients cannot open a browser sign-in page. With device authorization, the user approves the sign-in on a second device, such as a phone or another computer. Authentication stays with your identity provider and its policies.
Device authorization also works on Segura™ SaaS and with Proxy 2.0.
Database Proxy does not use device authorization, because a database client can only send a password. Users who sign in to Segura™ through an identity provider and have no local password use a temporary token as the database password. See About proxy access with temporary tokens.
Key concepts
- Device authorization: the OAuth 2.0 device authorization grant. The proxy shows a code, and the user approves it on the identity provider's page.
- Preferred username: the identity provider claim that Segura™ compares with the Segura™ username, set on the OpenID provider.
How it works
- The user starts a connection to the proxy and enters their Segura™ username.
- The proxy shows a link with the code included, the code itself, and a QR code that opens the link.
- The user opens the link or scans the QR code on any device and signs in to the identity provider.
- Segura™ receives the approval and identifies the user. The session opens.
Segura™ identifies the user by matching the Preferred username claim to the username of an active Segura™ user. That user must be the same user entered on the proxy. Segura™ never creates a user or grants partial access through device authorization.
If the code expires, the user denies the sign-in, or no matching user exists, the proxy shows the same authentication failure. The user starts a new connection to try again.
Segura™ does not ask for its multi-factor authentication (MFA) token when the user signs in with device authorization. The identity provider applies its own policy, including its MFA. If Segura™ is set to ask for an MFA token when a session starts, that request still applies. For details, see Access with MFA token.
What changes when you enable it
Device authorization applies to every user who connects to the proxies with a client, not to selected users. While it is enabled and working, the proxies ask every such user to sign in through it, including local users. Sessions that you open from the Segura™ web portal use the web portal sign-in.
The proxies fall back to username and password sign-in, with Segura™ MFA, only when device authorization is disabled or cannot start. For example, it cannot start when no provider has a complete configuration or the identity provider does not respond.
Device authorization uses only active OpenID providers with the Local environment, and only one of them. A provider with the Domum Remote Access environment is never used. If more than one active Local provider has it enabled, Segura™ warns you when you save a provider and names the provider in use.
Segura™ records changes to OpenID providers in the audit trail, without revealing secrets.
Supported identity providers
Device authorization works with any OpenID provider that supports the device authorization grant. It is validated with Microsoft Entra ID.