Connected Apps
Single sign-on for the app
nobody is allowed to change.
Every estate has one: a vendor console, an in-house tool, a legacy system with its own login page and no SSO support. Quadrazene logs in on the user's behalf, holds the session, and puts the app in front of them, so the login page stops being a separate thing to remember, secure and audit.
- The user signs in to Quadrazene with the directory they already use.
- Quadrazene posts the app's own login form on their behalf, transiently.
- The app's session cookie is kept server-side and cached.
- Every request to the app flows through the proxy, inside the workspace.
Three display modes
Pick how the app shows up.
Set per application, and change your mind without touching the app.
Link
Open the app from Quadrazene. No SSO, the user signs in to it themselves. The quickest smoke test that the app is reachable.
Embedded
The app renders inside the workspace, signed in for the user. Framing headers the app sends are stripped when you tell the proxy to.
SSO window
A real browser form POST to the app's login endpoint, opened in its own tab. A fallback when embedding is not wanted.
What it does for you
No changes to the app. Real changes to its security.
Pre-auth on sign-in
For tenants that sign in with RADIUS or LDAP, the same credentials can log the user into the connected app automatically, used transiently and never persisted.
Per-user vault
Where pre-auth is not an option, each person stores their own credential for the app once, in their own vault.
Session broker
The app's cookie is held server-side and cached in Redis, including Sentinel, TLS and ACL-protected deployments, so the browser never has to carry it.
Login-shape aware
Handles form-encoded and JSON login endpoints, custom field and cookie names, and a per-app upstream timeout.
Framing headers, on request
Most apps never expected to be embedded. Tell the proxy to strip their X-Frame-Options and CSP headers when you want them to render inside the workspace.
One place to license and control
Connected Apps is its own licensed product, and access goes through the same permission checks as everything else.
The hard case
An app that can't live under a sub-path.
Some single-page apps hard-code their base path and go blank when served under /applications/... The root-mount proxy gives such an app a path of its own.
Diagnose
The symptom is an embedded app that renders blank while the same app works in its own tab.
Root-mount
A small proxy container serves the app at the root of its own port, and the workspace frames that.
Still one session
Sign-in, session and access control are unchanged. Only where the app is mounted moves.
Retire the extra login page.
Name the app that has no SSO and we'll show it opening, signed in, from your directory.