.. meta::
   :description: Guide to different authentication options in ThinLinc Web Access..
   :keywords: automated logins, automation, SSO, Single Sign-On, integration

.. _tlwebaccess_authentication:

Authentication
--------------

ThinLinc Web Access supports two primary methods of authentication:
form-based authentication and OpenID Connect (OIDC). The form-based
authentication is the default mechanism on the login page, while OIDC is
recommended for environments requiring Single Sign-On (SSO).

It may be desirable to automatically log users into ThinLinc Web Access
from a non-ThinLinc service such as a web portal or an intranet page.
For more information on this, see :ref:`tlwebaccess_automation`.

.. _tlwebaccess_formbase_authentication:

Form-based authentication
~~~~~~~~~~~~~~~~~~~~~~~~~

Form-based authentication is the default method for ThinLinc Web Access.
It functions by sending a ``POST`` request containing the user's
credentials to the Web Access service. The service then processes these
credentials through the system's PAM (Pluggable Authentication Modules)
stack.

In a standard configuration requiring only a password, the ``POST``
request includes the parameters ``username`` and ``password``. The
structure of such a request can be represented by the following HTML
form:

.. code:: html

   <form method="post" action="https://tl.example.com:300/">
       <input type="hidden" name="username" value="<username>">
       <input type="hidden" name="password" value="<password>">
       <input type="submit" value="Login">
   </form>

On systems where Web Access has been configured through PAM to request
further information from the user, such as when 2FA is enabled, it is
possible to provide additional authentication parameters. For technical
details on how to provide these additional parameters, see
:ref:`tlwebaccess_legacy_automation`.


.. _tlwebaccess_oidc_authentication:

OpenID Connect authentication
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ThinLinc Web Access supports authentication via OpenID Connect (OIDC),
enabling single sign-on through external providers such as Microsoft
Entra ID or Keycloak, as seen in the following figure. When configured,
users click a button on the login page and are redirected to their
identity provider for authentication.

.. figure:: images/tlwebaccess-password-and-oidc.svg

   ThinLinc Web Access with OIDC login

For detailed setup instructions, see :ref:`authentication_oidc`.