Hi Experts!

My Service Provider organisation wish to authenticate our customers accessing Concerto using SSO and SAML.

Only Concerto is exposed to the Internet.

During testing, we found the client is redirected to our Director. But as Director isnt hosted on the Internet, we never see the SSO browser prompt on the client device. Consequentially, SSO fails.

1) do we need to host Director on the Internet?

2) if yes, is there a way to minimise the Directors footprint to minimise exposure to the Internet via a WAF or similar appliance?

Thanks in advance!