Marketplace
LIVESecurity / security
Zero-Trust Edge & Identity
Expose private AI services through centralized identity and outbound-only tunnel ingress.
Live workload cutawayArchitecture in context
Zero-Trust Edge & Identity
Signal path active6 deployment units
What this replaces
Self-hosted services commonly accumulate public ports, inconsistent login methods and ad-hoc per-app security.
What your team gains
A centralized edge with SSO, access policy, reverse-proxy controls and a tunnel architecture that does not require a publicly routable origin service port.
What is inside the blueprint
OIDC/OAuth2 provider and source roles
Authorization code, client credentials, device code, refresh token and token exchange support
SAML provider with metadata/signing/property mappings
LDAP provider with LDAPS and supported code-based MFA patterns
Proxy and forward-auth providers
Single-app or domain-level forward auth
SCIM 2.0 user/group provisioning and SCIM sources
Identity configuration as code
Reverse-proxy host/path routing
Middleware chains
TLS termination
Load balancing and health checks
Outbound-only edge tunnel
Block-all-ingress/allow-egress origin model
Tunnel replicas/failover and multiple connector connections
How it fits the platform
User -> edge network/tunnel -> reverse proxy -> authentication middleware -> protected application; origin initiates outbound tunnel connections.
Included services
Edge tunnel, Reverse proxy, Authentication, auth-worker, auth-db, Cache
Platform requirements
- AICORTEX Core PlatformThe edge terminates onto services Core deploys and routes.
From prerequisites to operation
Prerequisites
- Domain and edge tunnel provider account
- Identity source/user model
- TLS and route inventory
Deployment
- Create tunnel and routes
- Deploy reverse-proxy routing
- Deploy the authentication server, worker, database and cache
- Configure forward auth or OIDC per app
- Apply route-level policies
Configuration
- Providers/flows
- Groups/policies
- SCIM/LDAP/SAML if needed
- Forward-auth mode
- Tunnel replicas
- Reverse-proxy middleware and health checks
Operations
- User lifecycle
- Credential/token rotation
- Tunnel health
- Proxy header trust
- Policy review
- Auth database backups
What this unlocks with other layers
Zero-Trust AI Service
Remote AI access without exposing origin service ports, with centralized authentication and behavioral remediation.
Technology behind this capability
Relational databaseAuthenticationCacheReverse proxyEdge tunnel