External Identity Providers

Thinfinity Workspace supports multiple external authentication standards, enabling organizations to integrate with modern identity providers and centralized login systems. This flexibility allows users to authenticate using protocols like OAuth 2.0, SAML, and RADIUS, while administrators retain control over access policies.

IdPs streamline the login process and enhance user experience — for example, by enabling SSO. Unlike Directory Services, IdPs operate outside your business domain. Therefore, all users authenticating via an IdP must be mapped to an existing domain account in a Directory Service.

OAuth 2.0

Thinfinity Workspace uses OAuth 2.0 to delegate user authentication to External Identity Providers. When a user selects an OAuth-based login method, the platform redirects the browser to the IdP’s authorization page. After the user authenticates there, the IdP returns a token that Thinfinity Workspace uses to confirm the user’s identity — credentials are never shared with or stored by the platform.

• Use case: Organizations that rely on cloud-based identity providers or enterprise SSO platforms.
• Supported providers: Google, Facebook, LinkedIn, Dropbox, Azure, ForgeRock, Okta. Integration with additional providers is possible through the Other option in the configuration panel.

SAML

Thinfinity Workspace acts as a SAML 2.0 Service Provider (SP), consuming identity assertions issued by an external SAML Identity Provider (IdP) after the user authenticates. This enables enterprise SSO: the user signs in once at the IdP (such as Azure AD, Okta, Ping Identity, Google Workspace, ADFS, or any custom SAML-compliant provider), and the resulting assertion grants access to Thinfinity Workspace without additional credentials.

• Use case: Enterprise environments with centralized SSO infrastructure, particularly those already running Active Directory Federation Services (ADFS) or similar SAML-based systems.

RADIUS

Thinfinity Workspace can authenticate users by forwarding their credentials to a RADIUS server for validation. The RADIUS server evaluates the credentials against its configured backends and responds with an access decision. This integration allows environments that already use RADIUS for network access control — such as VPNs, firewalls, or Wi-Fi authentication — to extend the same infrastructure to Thinfinity Workspace sessions.

• Use case: Secure internal networks or VPN setups where RADIUS already serves as the centralized authentication point.