Infrastructure
The following diagram depicts a typical on-prem implementation of the Apporto system.
Infrastructure components
The on-premises architecture separates user access, orchestration, identity, and target desktop or application resources so each layer can be secured, scaled, and operated independently.
Control plane: Provides central orchestration, policy enforcement, session brokering, tenant configuration, monitoring, and administrative workflows. It coordinates session creation and directs users to the appropriate delivery path without exposing internal hosts unnecessarily.
Cluster nodes: Run the Apporto services that support session brokering, gateway functions, application delivery, and supporting platform workloads. Nodes should be deployed redundantly so maintenance or failure of one node does not interrupt the overall service.
Load balancer: Presents a stable entry point for users and routes HTTPS traffic to healthy cluster nodes. It should support health checks, TLS requirements, and the chosen high-availability model for the environment.
RDP or Hyperstream path: Carries the interactive desktop or application session from the platform to the user. Depending on the design, the path may use RDP-based connectivity, Hyperstream streaming, or both, with firewall rules limited to the approved ports and endpoints.
Identity integration: Connects Apporto to the organization’s identity provider, such as SAML, OAuth/OIDC, LDAP, or Active Directory, to authenticate users and apply group-based access policies. This integration should align with institutional MFA, account lifecycle, and authorization requirements.
Target hosts: Provide the desktops, applications, labs, or compute resources users access through Apporto. Target hosts should be segmented from public networks, sized for expected workloads, and managed using the organization’s standard patching, image, and monitoring processes.
Typical traffic flow
A user connects to the Apporto service URL through the load balancer over HTTPS.
The platform redirects or validates the user through the configured identity provider.
After authentication, the control plane evaluates user entitlement, policy, and available capacity.
A healthy cluster node brokers the session and establishes the approved RDP or Hyperstream delivery path.
The user is connected to the assigned target host, desktop, or application while monitoring and session state remain coordinated by the platform.
Architecture decision checklist