Overview
Choose the integration by where the application accepts identity and who enforces access. Begin with your first protected app if you are new to AuthCrunch.
| Goal | Integration | Access boundary |
|---|---|---|
| Protect an app behind Caddy | Authentication portal and authorization policy | Caddy validates the portal token and application roles before forwarding |
| Protect an app directly with an upstream OAuth provider | Direct OAuth policy | The policy owns an opaque browser session and evaluates claims |
| Let an application use AuthCrunch as an OIDC issuer | OIDC provider | Registered redirect/client, local account authentication, consent and code/PKCE flow |
| Let users sign into the portal through an enterprise SAML IdP | Upstream SAML login | Signed and browser-bound assertions become portal identities |
| Issue AWS console SAML assertions | AWS SSO status | Metadata/menu exist; assertion issuance is incomplete in the released runtime |
The portal's Applications page and UI links help users navigate to services. A link is not an access grant: protect the destination route with its own policy and test a signed-in account without the required app role.
Use the released-version table when choosing features. Upstream provider login, issuing tokens to downstream clients, and presenting a menu are distinct capabilities; one does not imply the others.