Websites

A website resource in StrongDM is the combination of an IP/DNS address and authentication information used to connect to a web-based resource, such as a Redash or Grafana dashboard.

When a User or Role is assigned a website resource, that entity inherits the ability to access the resource via a proxy set up on their local device.

Example: Alice wishes to access an internal website, such as a CI tool, which is already set up in StrongDM as a website resource. Alice sets up her StrongDM user, which is then given permission via a role to access the website. She installs StrongDM Client on her laptop, then is able to quickly access the site after connecting to it via the desktop app.

Validation of the token is not strictly necessary since the connection comes through StrongDM (and thus already is authenticated and authorized), but if you wish to manually validate it, you may do so with the VerifyJWT method in the SDKs. Each SDK has a version of this function, which reports whether the given JWT token is valid.

Currently, StrongDM supports websites with no authentication, basic HTTP authentication, or header-based authentication. Interactive logins and websites secured with SSO are not supported.

Add the Resource in StrongDM

Next, add the resource in StrongDM. This section provides instructions for adding the resource in either the StrongDM Admin UI, CLI, Terraform provider, or SDKs.

Admin UI

Set up and Manage With the Admin UI

If using the Admin UI to add the resource to StrongDM, use the following steps.

1. Log in to the Admin UI and go to Infrastructure > Servers.

2. Click Add server.

3. For Auth Type, select one of the following:

   1. HTTP: This type of connection does not attempt to perform any authentication via StrongDM, so it has no additional fields required. Just make sure your URL is correct.

   2. HTTP Basic Auth: This option uses standard HTTP authentication (username/password). Choosing this option exposes two additional fields: Digest Auth User (username) and Digest Auth Password (password).

   3. HTTP Custom Auth: This option sends custom auth data using the Authorization header. Once selected the field Authorization Header is exposed.

4. Set other resource properties.

5. Click create to save the resource.

6. Click the resource name to view status, diagnostic information, and setting details. After the server is created, the Admin UI displays that resource as unhealthy until the health checks run successfully. When the resource is ready, the Health icon indicates a positive, green status.

CLI

Terraform

SDKs

Resource Properties

Property	Requirement	Description
Display Name	Required	Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >)
Auth Type	Required	Select HTTP, HTTP Basic Auth, or HTTP Custom Auth; find a description for each in the Auth Types section
Proxy Cluster	Required	Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource
Base URL	Required	Base address and port for the website to add as a resource (for example, http://dashboard.strongdm.com:9021)
Connectivity Mode	Required	Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization
IP Address	Optional	If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization
Port Override	Optional	If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings
DNS	Optional	If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432)
HTTP Subdomain	Required	If Loopback Mode is the selected connectivity mode, a unique string to use as your local DNS address (for example, app-prod1 turns into http://app-prod1.production111.sdm.network/); be sure to input URL-safe characters
Default Path	Optional	Path that serves as the starting page when accessing the resource, for example, set /_plugins/kibana
Healthcheck Path	Optional	Change the healthcheck from the default / to a more specific URL; the path provided should return a healthy status code, such as 200
Headers exclusion	Optional	Headers to exclude from logging; by default, the logs in StrongDM include all of the headers passed to the website
Host Override	Optional	Value to overwrite the host header
Resource Tags	Optional	Datasource Tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev)

Auth Types

The "HTTP" in the names of each auth type is a only part of the descriptor of the authentication type. Website resources that are protected by SSL (HTTPS) are also supported.

• HTTP: This type of connection does not attempt to perform any authentication via StrongDM, so it has no additional fields required. Just make sure your URL is correct.

• HTTP Basic Auth: This option uses standard HTTP authentication (username/password). Choosing this option exposes two additional fields: Digest Auth User (username) and Digest Auth Password (password).

• HTTP Custom Auth: This option sends custom auth data using the Authorization header. Once selected the field Authorization Header is exposed.

Proxy Configuration

Once a user has access to a website, they also need to configure their local system proxy. Users can add the following PAC file to their system to accomplish this task: https://app.strongdm.com/proxy.pac.

The PAC file in the link above automatically configures your system to proxy traffic for your websites. For more detailed setup instructions, read Connect to Websites.

Headers

StrongDM modifies headers in the following ways:

• Changes are made to the Location header (as with most proxies).

• If the User-Agent header is missing, it is added with a blank value.

• In the case of HTTP (Basic Auth) and HTTP (Custom Auth) resource types, StrongDM adds or modifies the related auth headers.

• The X-Forwarded-User header contains the email of the StrongDM user.

• The X-Sdm-Token header contains a JSON Web Token (JWT) that can be used to verify the user's authentication.

These headers are modified for internal use, but the information is presented here because there may be some use cases where you may wish to configure or modify your web applications to anticipate or use some of these headers.

Test the Connection

1. In the Admin UI, locate your new website resource and check its health status. A green indicator means StrongDM can reach the site’s base URL and health path.

2. From a user machine with the StrongDM desktop app or CLI running, open your browser and navigate to:

   https://<HTTP_SUBDOMAIN>.<ORGANIZATION>.sdm.network/

   (or include your configured default path if set).

3. Confirm that the website loads successfully:

   • For HTTP Basic Auth, verify login with the configured credentials.

   • For HTTP Custom Auth, confirm your application responds normally using the injected header.

   • For No Auth, confirm the site opens without prompts.

4. If the site doesn’t load:

   • Verify the health path returns a 200 OK status.

   • Check your PAC file or proxy settings if you’re using automatic proxy configuration.

   • Ensure that the StrongDM node can reach the target URL.

5. Once the website loads correctly and the health status shows green, the resource is ready for use.

If you encounter issues, please consult the StrongDM Help Center.