has a plugable security framework and offers a variety of built-in Security Managers. The Security Managers supported by are listed below:

On This Page:

frevvo Default Security Manager - is responsible for authentication/authorization and managing users/roles. This is the default option. Your tenant will be created with this security manager if no other choice is selected. If you use the Default Security Manager, a tenant admin can create users and roles directly in your tenant.
LDAP Active Directory Security Manager - The user is authenticated outside using LDAP directly. This Security Manager by itself does not provide SSO. For Live Forms In-house customers using Microsoft IIS, SSO is available.

When using the LDAP Security Manager, groups are the equivalent of Live Forms roles.
SAML Security Manager - This security manager allows the exchange of authentication and authorization data between an identity provider of your choice (ex:Shiboleth, Okta, ADFS, etc...) and a service provider (frevvo). SSO is supported. Although this security manager can be used on-premise it is primarily meant for cloud tenants who use LDAP but do not want to expose it over the internet.
Azure SAML Security Manager - This security manager uses SAML in Authentication Only mode and the Active Directory available in the Microsoft Cloud solution, Azure. Azure AD can integrate with Microsoft AD providing a simple and secure way to access identity managment in the frevvo cloud.
Delegating Security Manager - this is the Security Manger needed for Confluence integration.

When using the Delegating Security Manager, groups are the equivalent of Live Forms roles.
DB Container Security Manager - Authentication is the container's responsibility, but provides a database interface to fetch users/roles for design time functionality from an external database.
LDAP Container Security Manager - This is exactly the same as the DB Container Security Manager but LDAP instead of DB. Authentication is the container's responsibility.
Custom - Container managed security manager used when there is a requirement for a container to handle authentication.

Which Security Manager do I choose?

Many frevvo customers use the Default Security Manager. All tenants are initially created with this Security Manager. It is the simplest security manager because it does not require integration with an external IDP. Users/roles are managed by the tenant admin.

Live Forms offers additional Security Managers, implemented to industry standards, that may be more compatible with your environment. You must have the expertise for setting up your security infrastructure in such a way that whatever choice you make (cloud, ldap, saml, azure) is in fact secure and in compliance with any/all of your auditing requirements.

Selecting a Security Manager for your Live Forms tenant is a very important decision. The table helps you make the choice.

	LDAP	SAML	Azure
Cloud or on-premise	Both - Some organizations do not want to expose LDAP to the internet so they choose on-premise. Read how LDAPs in the cloud is secure.	Both - Primarily used for cloud tenants who do not want to expose their LDAP directly to the internet	Both - provides a simple and secure way to access identity management (azure AD) in the cloud
Are Users/Roles automatically synchronized with your Live Forms tenant(s) ?	Yes - Manual user/role sync (via frevvo csv upload for example) is not required. The frevvo server automatically gets users & roles from LDAP.	No - if “auth only” mode selected - Manual or automated csv uploads required on a regular basis Partial sync if discovery mode ( “auth only” off). User details and user’s roles are automatically discovered each time the user logs into the tenant. Thus the tenant can get out of sync with your IDP therefore manual or automated csv uploads on a regular basis are still recommended.	Yes - Manual user/role sync (via frevvo csv upload for example) is not required. The frevvo server automatically gets users & roles from Azure AD.
Single Sign On	Cloud - not available In-house - Must configure IIS using the IIS to Tomcat Connector	Yes	Yes
Authentication Only Mode Choice	No - You must change your IDP (LDAP in this case) to have roles you need in your frevvo workflow if they do not already exist. All user information is maintained in LDAP	Yes	Yes
Authentication Only = Yes	Not Supported	SAML handles authentication only - roles/users managed & maintained via the tenant Users/Roles UI. Changes made via the tenant Users/Roles UI do not get overridden when user logs in/out. You may choose this mode if: You do not want to add roles to your LDAP. LDAP has many roles that have no relevance to your workflow. Find the SAML mapping for the other required attributes complex. For some IDPs, retrieving the manager user id and role names may require writing custom rules. Con - (1) All user information (email address) must be managed by the frevvo tenant admin. This can get out of sync with your IDP. Pro - You can add roles for frevvo workflow without having to edit your IDP	Users and roles are defined in Azure AD.
Authentication Only = No	This is the only mode allowed in this SM and this property does not even exist to change it. Groups needed for these user types in your IDP: All Users that will have access to Live Forms must be members of the frevvo.user group. Designer users must be members of the frevvo.user and frevvo.Designer groups Tenant Admins must be members of the frevvo.User and frevvo.TenantAdmin groups Users are discovered immediately the first time the tenant connects to the IDP and are automatically and always kept in sync without any manual intervention.	Groups needed for these user types in your IDP: All Users that will have access to Live Forms must be members of the frevvo.user group. Designer users must be members of the frevvo.user and frevvo.Designer groups Tenant Admins must be members of the frevvo.User and frevvo.TenantAdmin groups Users discovered when they log in. Changes made via the the tenant Users/Roles UI are overwritten if user logs out then in again.	Users and roles are defined in Azure AD.
If your company uses LDAP as your IDP, do you need to install additional software to use this frevvo Security Manager?	No	Yes - (Either install one of the SAML 2.0 Implementations such as ADFS or use a cloud provider such as Okta, and configure it to talk to your LDAP server)	Yes (You must purchase Azure AD in the cloud)
Can I embed frevvo forms/flows into my website with this Security Manager?	Yes	Yes - if the visibility of the form is set to Public. Yes - if the visibility of the form is set to Public in Tenant and the user is already authenticated to SAML No - if the visibility of the form is set to Public in Tenant and the user is NOT already authenticated to SAML. This is because frevvo must direct the user to the IDP login screen and the browser will not allow loading the IDP login page in frevvo's form iframe.	Yes - if the visibility of the form is set to Public. Yes - if the visibility of the form is set to Public in Tenant and the user is already authenticated to Azure SAML. No - if the visibility of the form is set to Public in Tenant and the user is NOT already authenticated to Azure SAML. This is because frevvo must direct the user to the IDP login screen and the browser will not allow loading the IDP login page in frevvo's form iframe.
What does frevvo support?	Microsoft AD, Open LDAP	Shibboleth, ADFS, Okta, Centrify, Google and any other software that implements the SAML 2.0 protocol	There is no other implementation of Azure AD then Azure AD
What does frevvo certify?	Microsoft AD	none	Azure AD
Do you need your own Configuration Specialist for your IDP	Yes	Yes	Yes

Changing the Security Manager for your Tenant

trial tenants are configured with the default security manager. Once you have purchased a license for your tenant the “Change Security Manager” feature becomes enabled.

The following Security Manager changes are currently supported:

Tenants using the Default Security Manager can be migrated to:

Default Security Manager → LDAP
Default Security Manager → SAML
Default Security Manager → Azure SAML

Tenants using the LDAP Security Manager can migrate to:

LDAP → SAML
LDAP → Azure SAML

If you are still evaluating and want to switch the Security Manager of your tenant to the LDAP, SAML or Azure Security Managers on a trial basis, contact sales@frevvo.com to initiate the process.

If you know that you will be changing from the frevvo Default Security Manager to one of the other types after your trial period, we strongly recommend:

Create users in the default security manager with the same user names as the users in your target identity provider. For Example if you plan to switch to LDAP, make sure your users have the same names as those in your AD server. After you switch from the Default Security Manager to one of the other Security Managers any users that do not exist in the target IDP will no longer be accessible.
If you fail to follow this recommendation don’t stress all is not lost. :) You can still download your frevvo applications from those users and upload them into the new users that are created via your IDP.

customers should be aware that changing the Security Manager of your tenant is a ONE-WAY operation. Once completed you cannot change it back to the original security manager.