SugarCRM 101: Authentication

Did you know that Sugar supports 3 different mechanisms for authenticating a user upon them attempting to access the application? 

The authentication options are:

Sugar

LDAP

SAML

The Sugar option refers to the standard username/password combination an administrator can configure within Sugar, as described here:

https://support.sugarcrm.com/Documentation/Sugar_Versions/8.3/Ent/Administration_Guide/Users/#Regular_and_Admin_Users

If your organization maintains an LDAP capable server, such as Microsoft ActiveDirectory (AD), it is possible to utilize the AD user list to authenticate users attempting to access Sugar. Further details on configuring this option can be found here:

https://support.sugarcrm.com/Knowledge_Base/Password_Management/Configuring_LDAP_Authentication_Using_Active_Directory/

The third option, SAML, is similar in nature to LDAP in that the user list is maintained outside of Sugar, but access to Sugar can be obtained by providing a set of valid SAML credentials. Greater detail on using this option is given in this example:

https://support.sugarcrm.com/Knowledge_Base/Password_Management/Configuring_SSO_With_Okta/

These options provide a flexible authentication model for Sugar, but the options aren't mutually exclusive and their interaction can sometimes cause a bit of confusion.

For example, it is possible to configure a Sugar instance to use SAML and at the same time allow a user to access the instance by either providing SAML or standard Sugar credentials. It is also possible to configure Sugar such that the LDAP/SAML option is only applicable to certain users.

To alleviate some of that confusion, I have created the below flowchart to describe the process used by Sugar, taking into account the various authentication options that can be configured. 

Figure 1.1 - Authentication Process

I hope this helps answer some of your questions on authentication and Sugar.