> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/gateway.md). # Administer the Access Gateway Route to the right Access Gateway page — understand the model, publish an application, transform its requests and responses, read the reference, or diagnose a failure. ## What this is, and when you need it The **Access Gateway** — historically the **rProxy** — puts an application that cannot speak SAML, OAuth 2.0 or OpenID Connect behind OpenIAM authentication and authorization without changing the application. It sits in front of the application, terminates the OpenIAM session, asks OpenIAM on every request whether this user may have this URI by this method, and forwards the request upstream with identity attached as headers, cookies, query parameters or a submitted login form. Your working surface is the **content provider** in the Webconsole and its **URI Patterns**; installing and tuning the proxy itself belongs to the [Installation Guide](/installation/installation.md). If the application *can* speak a federation protocol, use that instead — it is a better fit in every respect. See [Configure federation and application SSO](/administration-guide/federation.md). ## Start here Do these in order. Each one assumes the previous one is working, and skipping ahead makes every failure harder to read. 1. [How the Access Gateway works](/administration-guide/gateway/access-gateway.md) — ten minutes, and it decides whether the gateway is even the right answer for your application. 2. [Protect an application behind the Access Gateway](/administration-guide/gateway/protect-an-application.md) — one content provider, one URI pattern, one upstream, no injection. Prove this before anything else. 3. [Give the application the authenticated identity](/administration-guide/gateway/inject-identity.md) — headers, parameters, cookies or form fill — form-based single sign-on into an application that has only a login page — once proxying is proved. 4. [Advanced request and response transformations](/administration-guide/gateway/request-and-response-transformations.md) — only when a page misbehaves. 5. [Kerberos and desktop SSO](/administration-guide/gateway/kerberos.md) — last. Kerberos is an addition to a gateway you have already proved works with passwords; enabling it over a proxy that does not work fails by silently falling back to the login form. ## Choose your outcome | I want to… | Go to | | ---------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Understand what the gateway is and where it sits | [How the Access Gateway works](/administration-guide/gateway/access-gateway.md) | | Decide whether my application can be proxied at all | [Can your application be proxied?](/administration-guide/gateway/access-gateway.md#can-your-application-be-proxied) | | Publish a legacy application end to end | [Protect an application behind the Access Gateway](/administration-guide/gateway/protect-an-application.md) | | Make one path demand stronger authentication than the rest of the site | [Demand a different authentication on one URL](/administration-guide/gateway/protect-an-application.md#demand-a-different-authentication-on-one-url) | | Give the application identity as headers, parameters or cookies | [Header and parameter injection](/administration-guide/gateway/inject-identity.md#header-and-parameter-injection) | | Sign a user in to an application that only has a login form — form fill, also called form-based SSO, credential injection or password vaulting | [Form fill](/administration-guide/gateway/inject-identity.md#form-fill) | | Fix absolute URLs the application emits | [URL rewriting](/administration-guide/gateway/request-and-response-transformations.md#url-rewriting) | | Send one path somewhere else instead of proxying it | [Per-pattern redirects](/administration-guide/gateway/request-and-response-transformations.md#per-pattern-redirects) | | Fix where users land after they sign in | [Where the user lands after authenticating](/administration-guide/gateway/request-and-response-transformations.md#where-the-user-lands-after-authenticating) | | Put our stylesheet and logos on the pages OpenIAM renders | [Brand the pages OpenIAM renders for this site](/administration-guide/gateway/request-and-response-transformations.md#brand-the-pages-openiam-renders-for-this-site) | | Give domain-joined workstations password-free sign-in | [Kerberos and desktop SSO](/administration-guide/gateway/kerberos.md) | | Look up a metadata type, a status code, a property or a directive name | [Access Gateway reference](/administration-guide/gateway/access-gateway-reference.md) | | Look up a field on the content provider or URI pattern form, or its shipped default | [Content provider and URI pattern reference](/administration-guide/access/content-providers-and-uri-patterns/content-provider-reference.md) | | Diagnose a request that fails through the gateway | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md) | | Nobody can sign in and the UI log repeats *"No Authentiation Provider was found"* | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md#no-authentiation-provider-was-found-what-actually-broke) | | One named user cannot sign in, and the gateway is not the problem | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md) | | Keep a mobile client's session alive while it sits idle | [Session lifetime and renewing the session cookie](/administration-guide/gateway/access-gateway-reference.md#session-lifetime-and-renewing-the-session-cookie) | | Install, tune or containerise the proxy itself | The [Installation Guide](/installation/installation.md) | ## Two things to know before your first change **Changes take effect on a timer.** OpenIAM refreshes its URI-federation cache every 30 seconds and its content-provider cache every 300 seconds, and the Webconsole says so on every save. Make one change, wait it out, test — rather than changing three things and guessing afterwards which of them did what. {% hint style="danger" %} Gateway configuration decides how people reach the Webconsole, so a mistake can lock you out of the tool you would use to fix it. Establish and **test** a break-glass administrator and a route to the Webconsole that does not depend on the pattern you are about to touch, before your first change — see [Change configuration safely](/administration-guide/start/change-safely.md). Recovering without one means asking the deployment owner to reopen the bootstrap path. {% endhint %} ## Related * [Content providers and URI patterns](/administration-guide/access/content-providers-and-uri-patterns.md) — the two objects every gateway surface is configured on, field by field * [Configure federation and application SSO](/administration-guide/federation.md) — the protocols to prefer where the application supports them * [Authentication providers and MFA](/administration-guide/security/authentication-providers-and-mfa.md) — the provider a content provider points at * [Where settings live](/administration-guide/start/where-settings-live.md) — which gateway value is a directive, an environment variable, a database row or a Webconsole field *Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/gateway.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.