- frevvo Default Security Manager - Live Forms is responsible for authentication/authorization and managing users/roles. This is the default option. Your tenant will be created with this security manager if no other choice is selected.
- LDAP Active Directory Security Manager - The user is authenticated outside Live Forms. Typically, SSO or Live Forms performs the authentication using LDAP directly.
- SAML Security Manager - This security manager allows the exchange of authentication and authorization data between an identity provider of your choice (ex:Shiboleth) and a service provider (frevvo). SSO is supported. Although this security manager can be used on-premise it is primarily meant for cloud tenants who use LDAP but do not want to expose it over the internet.
- Azure SAML Security Manager - This security manager uses SAML in Authentication Only mode and the Active Directory available in the Microsoft Cloud solution, Azure. Integration with the Azure API enables Live Forms queries. On-premise AD services can be exposed via Azure providing a clean way to integrate with the frevvo cloud.
- Delegating Security Manager - this is the Security Manger needed for Confluence integration.
- DB Container Security Manager - Authentication is the container's responsibility, but Live Forms provides a database interface to fetch users/roles for design time functionality from an external database.
- LDAP Container Security Manager - This is exactly the same as the DB Container Security Manager but LDAP instead of DB. Authentication is the container's responsibility.
- Custom - Container managed security manager used when there is a requirement for a container to handle authentication.
Which Security Manager do I choose?
Many frevvo customers use the Default Security Manager. All tenants are initially created with this Security Manager. It is the simplest security manager because it does not require integration with an external IDP. Users/roles are managed by the tenant admin.
Live Forms offers additional Security Managers, implemented to industry standards, that may be more compatible with your environment. You must have the expertise for setting up your security infrastructure in such a way that whatever choice you make (cloud, ldap, saml, azure) is in fact secure and in compliance with any/all of your auditing requirements.
Selecting a Security Manager for your Live Forms tenant is a very important decision. The table helps you make the choice.
|Cloud or on-premise||Both - Some organizations do not want to expose LDAP to the internet so they choose on-premise. Read how LDAPs in the cloud is secure.||Both - Primarily used for cloud tenants who do not want to expose their LDAP directly to the internet||Both - provides a simple and secure way to access identity management (azure AD) in the cloud|
Are Uses/Roles automatically synchronizied with your Live Forms tenant(s) ?
|Yes - Manual user/role sync (via frevvo csv upload for example) is not required. The frevvo server automatically gets users & roles from LDAP.|
No - if “auth only” mode selected - Manual or automated csv uploads required on a regular basis
Partial sync if discovery mode ( “auth only” off). User details and user’s roles are automatically discovered each time the user logs into the tenant. Thus the tenant can get out of sync with your IDP therefore manual or automated csv uploads on a regular basis are still recommended.
|Yes - Manual user/role sync (via frevvo csv upload for example) is not required. The frevvo server automatically gets users & roles from Azure AD.|
|Single Sign On|
Cloud - not available
In-house - Must configure IIS with Idapi filter
|Authentication Only Mode Choice||No - You must change your IDP (LDAP in this case) to have roles you need in your frevvo workflow if they do not already exist. All user information is maintained in LDAP||Yes||Yes|
|Authentication Only = Yes||Not Supported|
SAML handles authentication only - roles/users managed & maintained via the tenant Users/Roles UI.
Changes made via the tenant Users/Roles UI do not get overridden when user logs in/out.
Con - (1) All user information (email address) must be managed by the frevvo tenant admin. This can get out of sync with your IDP.
Pro - You can add roles for frevvo workflow without having to edit your IDP
Azure handles authentication only. Authorization happens based on the roles defined in Azure AD.
Authentication Only mode is recommended if you are using the Azure Security Manager. It is checked by default.
|Authentication Only = No|
This is the only mode allowed in this SM and this property does not even exist to change it.
Groups needed for these user types in your IDP:
Users are discovered immediately the first time the tenant connects to the IDP and are automatically and always kept in sync without any manual intervention.
Groups needed for these user types in your IDP:
Users discovered when they log in.
Changes made via the the tenant Users/Roles UI are overwritten if user logs out then in again.
|The option to turn off Authentication Only mode is not available when configuring the Azure SAML tenant.|
|If your company uses LDAP as your IDP, do you need to install additional software to use this frevvo Security Manager?||No||Yes - (Either install one of the SAML 2.0 Implementations such as ADFS or use a cloud provider such as Okta, and configure it to talk to your LDAP server)||Yes (You must purchase Azure AD in the cloud)|
|What does frevvo support?||Microsoft AD, Open LDAP||Shibboleth, ADFS, Okta, Centrify, Google and any other software that implements the SAML 2.0 protocol||There is no other implementation of Azure AD then Azure AD|
|What does frevvo certify?||Microsoft AD||none||Azure AD|
|Do you need your own Configuration Specialist for your IDP||Yes||Yes||Yes|
Changing the Security Manager for your Tenant
Live Forms trial tenants are configured with the default security manager. Once you have purchased a license for your Live Forms tenant the original security manager can be changed. This allows you to keep the submissions and the name of your existing tenant.
Tenants using the Default Security Manager can be migrated to:
- Default Security Manager → LDAP
- Default Security Manager → SAML
- Default Security Manager → Azure SAML
Tenants using the LDAP Security Manager can migrate to:
- LDAP → SAML
- LDAP → Azure SAML
Cloud customers, planning to switch the Security Manager of your tenant from the default to the LDAP, SAML or Azure SAML Security Managers or a tenant using the SAML security manager on a trial basis should contact firstname.lastname@example.org to initiate the process.
If you are are using LDAP for authentication, here's what we recommend:
- Make sure the users created in the default security manager tenant have the same user names as the users in your LDAP server..
- Users need the frevvo.User role to access Live Forms. This should be configured in Active Directory on your LDAP server.