> [!WARNING]
> **Note:** This section describes how to use an external identity provider with the new Edge UI. It is not intended for users of the Classic UI. See [IDP
> authentication (Classic UI)](https://docs.apigee.com/private-cloud/v4.52.01/external-authentication-configuration-overview) for the Classic UI.

The New Edge UI and Edge management API operate by making requests to the Edge Management Server,
where the Management Server supports the following types of authentication:

- **Basic authentication:** Log in to the New Edge UI or make requests to the Edge management API by passing your username and password.
- **OAuth2 / OIDC:** Exchange your Edge Basic Auth credentials for an OAuth2 access token and refresh token. Make calls to the Edge management API by passing the OAuth2 access token in the Bearer header of an API call.

Edge supports using the following external Identity Providers (IDPs) for authentication:

- **Security Assertion Markup Language (SAML) 2.0:** Generate OAuth access tokens from SAML assertions returned by a SAML identity provider.
- **Lightweight Directory Access Protocol (LDAP):** Use LDAP's search and bind authentication methods to generate OAuth access tokens.

> [!NOTE]
> **Note:** SAML and LDAP are supported as authentication mechanisms only. They are not supported for authorization. Therefore, you still use the Edge SymasLDAP database to maintain authorization information.
>
> See [Assigning roles](https://docs.apigee.com/api-platform/system-administration/understanding-roles)
> for more.

Both SAML and LDAP IDPs support a single sign-on (SSO) environment. By using an external IDP
with Edge, you can support SSO for the New Edge UI and API in addition to any other services that you
provide and that also support your external IDP.

## About new Apigee SSO structure

Starting in Edge for Private Cloud 4.54.00, the legacy `apigee-sso` component has been replaced by a modernized, lightweight OpenID Connect (OIDC) identity broker called Dex. This SSO adapter is integrated directly into the `apigee-openldap` component lifecycle, removing the need to install a separate `apigee-sso` module.

Because the Apigee SSO (Dex broker) is bundled with `apigee-openldap`, it is deployed on the same nodes as your OpenLDAP instances. Lifecycle management is handled natively via OPDK actions such as `apigee-service apigee-openldap start_sso` and `stop_sso`.

> [!NOTE]
> **Note:**
>
> - `apigee-service apigee-openldap start` (and `restart`) checks whether SSO is enabled or not. (`ENABLE_SSO` in configuration file used during setup, or `lib_settings_enable_sso` in `/opt/apigee/customer/application/openldap.properties`) and only starts Dex if it is enabled.
> - `apigee-service apigee-openldap start_sso` ignores ENABLE_SSO and unconditionally starts the Dex process. Therefore, if a user configures properties manually and starts Dex via start_sso without ENABLE_SSO=y (via `setup-sso`), Dex will run initially but will NOT auto-start on subsequent `apigee-openldap` restart or node reboots.

Port 9099 must be open on the `apigee-openldap` node to support access to the Apigee SSO from a browser,
from the external SAML or LDAP IDP, and from the Management Server and New Edge UI. As part of configuring
the Apigee SSO, you can specify whether the external connection uses HTTP or the encrypted HTTPS
protocol.

The Apigee SSO is a stateless service that uses a Postgres database (`apigee_dex`) accessible on port 5432 on the Postgres node to persist OAuth2 state across multiple nodes, ensuring High Availability. Typically, you
can use the same Postgres server that you installed with Edge, either a standalone Postgres
server or two Postgres servers configured in master/standby mode. If the load on your Postgres
server is high, you can also choose to create a separate Postgres node just for the SSO database.

## Support for standard OpenID Connect (OIDC)

The Edge implementation of SAML and LDAP relies on standard OpenID Connect (OIDC) and OAuth2 access tokens.
The modernized Apigee SSO issues strictly OIDC-compliant tokens (utilizing standard claims like `email` and `sub`, as well as opaque refresh tokens). For more information, see
[Introduction to OAuth 2.0](https://docs.apigee.com/api-platform/security/oauth/oauth-introduction).

## About SAML

SAML authentication offers several advantages. By using SAML you can:

- Take full control of user management. When users leave your organization and are deprovisioned centrally, they are automatically denied access to Edge.
- Control how users authenticate to access Edge. You can choose different authentication types for different Edge organizations.
- Control authentication policies. Your SAML provider may support authentication policies that are more in line with your enterprise standards.
- You can monitor logins, logouts, unsuccessful login attempts and high-risk activities on your Edge deployment.

With SAML enabled, access to the New Edge UI and Edge management API uses OAuth2 access tokens.
These tokens are generated by the Apigee SSO which accepts SAML assertions returned by
your IDP.

## About LDAP

The Lightweight Directory Access Protocol (LDAP) is an open, industry-standard application
protocol for accessing and maintaining distributed directory information services. Directory
services may provide any organized set of records, often with a hierarchical structure, such as a
corporate email directory.

LDAP authentication within the new Apigee SSO uses its built-in LDAP connector. The connector performs LDAP searches for `organizationalRole` and standard attributes (such as `mail` and `uid`) to natively map Apigee legacy users to standard OIDC claims.

LDAP with Edge for the Private Cloud supports standard Search and Bind authentication methods against an LDAP-compatible server.

The Apigee SSO retrieves the user's email address and standard OIDC claims
(for example, `email`, `preferred_username`, and `groups`)
and updates the internal user record
so that there is a current email address on file, as Edge uses this email for authorization
purposes.

## New Edge UI and API URLs

The URL that you use to access the New Edge UI and Edge management API is the same as used before
you enabled SAML or LDAP. For the New Edge UI:

```
http://edge_UI_IP_DNS:3001
```

Where <var translate="no">edge_UI_IP_DNS</var> is the IP address or DNS name of the machine
hosting the New Edge UI. As part of configuring the New Edge UI, you can specify that the connection use
HTTP or the encrypted HTTPS protocol.

For the Edge management API:

```
http://ms_IP_DNS:8080/v1
```

Where <var translate="no">ms_IP_DNS</var> is the IP address or DNS name of the Management
Server. As part of configuring the API, you can specify that the connection use HTTP or the
encrypted HTTPS protocol.

## Configure TLS with New Apigee SSO

By default, the connection to the Apigee SSO uses HTTP over port 9099 on the node hosting
`apigee-openldap`. The lightweight Go-based identity broker natively handles HTTP and HTTPS requests.

The Apigee SSO supports three connection modes:

- **DEFAULT:** The default configuration supports HTTP requests on port 9099.
- **SSL_TERMINATION:** Enables TLS access to the Apigee SSO on the port of your choice. You must specify a TLS key and cert for this mode.
- **SSL_PROXY:** Configures the Apigee SSO in proxy mode, meaning you installed a load balancer in front of the component and terminated TLS on the load balancer. You can specify the port used on the Apigee SSO for requests from the load balancer.