Twingate

Twingate is a Zero Trust Network Access (ZTNA) platform that provides secure, policy-based access to private resources through lightweight Connectors and a cloud-based Controller. It replaces traditional VPN architectures by brokering encrypted, identity- and device-aware connections between users and internal systems—without exposing resources to the public internet.

Key Capabilities

• IdP integration & SSO (SP/RP role): Uses OpenID Connect (OIDC) for secure SSO to the Twingate Admin and User portals. Published setup guides for Okta and Microsoft Entra ID include step-by-step OIDC configuration and app registration workflows.

• Automatic provisioning (SCIM 2.0 inbound): Supports SCIM 2.0 for automated user and group synchronization from IdPs such as Okta, Entra ID, and OneLogin, with full documentation and integration gallery examples.

• Device security posture: Enforces Zero Trust principles by validating device posture—including trusted profiles, certificates, and endpoint status—before granting access. Admins can define Trust Methods and conditional policies per resource or group.

• Audit & diagnostics: Provides Audit Logs for user and administrative actions, plus real-time Connector telemetry and log export options for monitoring network activity and compliance audits.

Limitations

• Not an app IdP: Twingate’s OIDC/SAML implementation is strictly for authenticating into Twingate itself—it does not issue SAML/OIDC tokens to third-party applications. App federation remains your IdP’s role.

• Protocol scope: Documentation focuses primarily on OIDC; there’s insufficient public information confirming Twingate’s operation as a SAML SP or IdP for console login. RADIUS integrations are not part of the core architecture.

• SCIM directionality: Inbound SCIM (from IdP to Twingate) is well-documented, but outbound SCIM support from Twingate to downstream systems is not publicly confirmed.

• Session visibility: While audit and connection telemetry are provided, there is no public indication of full session recording/replay for SSH, RDP, or database traffic.