Latest update: 7.0.2
- Preface
- About IG
- IG As an HTTP Gateway
- Processing Requests and Responses
- Development Mode and Production Mode
- Decorators
- Configuration Parameters Declared as Property Variables
- Changing the Configuration and Restarting IG
- Understanding IG APIs With API Descriptors
- Sessions
- Secrets
- Installation in Detail
- About Securing Connections
- Installing IG in Standalone Mode
- Installing IG in Apache Tomcat
- Installing IG in Jetty
- Installing IG in JBoss EAP
- Preparing the Network
- Changing the Default Location of the Configuration Folders
- Preparing For Load Balancing and Failover
- Configuring IG For HTTPS (Client-Side)
- Using JWT Sessions
- Setting Up AM
- Getting Login Credentials From Data Sources
- Getting Login Credentials From AM
- Single Sign-On and Cross-Domain Single Sign-On
- Enforcing Policy Decisions From AM
- Hardening Authorization With Advice From AM
- Protecting Against CSRF Attacks
- Acting As a SAML 2.0 Service Provider
- Acting As an OAuth 2.0 Resource Server
- Acting As an OpenID Connect Relying Party
- Transforming OpenID Connect ID Tokens Into SAML Assertions
- Supporting UMA Resource Servers
- Configuring Routers and Routes
- Proxying WebSocket Traffic
- Implementing Not-Enforced URIs for Authentication
- Configuration Templates
- Extending IG
- Throttling the Rate of Requests to Protected Applications
- SAML 2.0 and Multiple Applications
Hardening Authorization With Advice From AM
To protect sensitive resources, AM policies can be configured with additional conditions to harden the authorization. When AM communicates these policy decisions to IG, the decision includes advices to indicate what extra conditions the user must meet.
Conditions can include requirements to access the resource over a secure channel, access during working hours, or to authenticate again at a higher authentication level. For more information, see AM's Authorization Guide.
The following sections build on the policies in Enforcing Policy Decisions From AM to step up the authentication level: