Skip to content
← All scenarios

Local availability

Keep sign-in local when connectivity matters.

Own the identity services your local applications depend on. Configure an on-premises deployment so its sign-in path can operate without public internet access.

Plan your implementation
Sign-in within the local operational environment Local applications, ProAuth, user store and database are within the operational environment. Applications use OIDC/OAuth. Local accounts and persistence are separate relationships. All required services must be available locally.LOCAL OPERATIONAL ENVIRONMENTLocal applicationsOIDC / OAuth clientsProAuthOpenID Provider /Authorization ServerProAuth user storeLocal identitiesLocal databaseSQL Server / PostgreSQLOIDC / OAuth 2.0Local accountsPersistence
Sign-in within the local operational environment Local applications, ProAuth, user store and database are within the operational environment. Applications use OIDC/OAuth. Local accounts and persistence are separate relationships. All required services must be available locally.LOCAL OPERATIONAL ENVIRONMENTLocal applicationsOIDC / OAuth clientsProAuthOpenID Provider /Authorization ServerProAuth user storeLocal identitiesLocal databaseSQL Server / PostgreSQLOIDC / OAuth 2.0Local accountsPersistence
Required services stay within the local operating environment.

The business situation

Sign-in is needed when the internet is unavailable

An operational site uses internal applications throughout the working day. Its team wants people to sign in using locally available identity services, even when the public internet connection is interrupted.

01 / Working model

Keep local sign-in locally available

For applications that must authenticate during an internet outage, deploy the required identity services and dependencies locally. Use local ProAuth accounts or a reachable local identity provider, with locally available recovery and administration processes.

On-premises Active Directory integration separates sign-in from provisioning: OIDC federation can use ADFS, while the ProAuth Directory Sync component sends directory changes to ProAuth's SCIM endpoint. SCIM requires Enterprise entitlement.

This makes local authentication an explicit architectural choice. Continuity of the complete operational application also depends on its other services.

Reachability is part of the architecture.

External identity providers and messaging services still require connectivity when your configuration depends on them. Validate sign-in, recovery and administration without public internet access.

Review deployment dependencies →

What your team gains

Keep the sign-in path local
Run ProAuth and the identity dependencies required for these applications on site.
Use the accounts that fit
Configure local user stores, one or more reachable local OIDC providers, or both in one deployment.
Keep a familiar integration
Applications use the same ProAuth protocols and APIs as connected environments.
02

One deployment, configured for local work

A single ProAuth deployment can serve multiple local applications and combine user stores with reachable local identity providers. Separate installations are an option when isolation or connectivity boundaries require them, not a requirement for combining identity sources.

Custom authentication views can adapt the presentation to different interfaces. Validate the browsers, authenticators and integration available on the devices your users actually use.

03

Operate for continuity

Configure and validate availability, capacity, backup and recovery for the local deployment. Product updates must be tested with the complete application and deployed according to the release requirements.

The configured sign-in path can operate without public internet access only when all its required services remain locally available. Availability of the wider application also depends on its other services and the local infrastructure.

Details for your decision.

Let’s plan your implementation.

Trace the complete sign-in and recovery path with public internet access removed. Check every required service, identity source and administrative process.

Discuss your offline requirements

Image detail