--- version: "1.50" language: "en" --- # Federation ## Definition A **Federation**is a configuration allowing an application to be integrated with Memority using standard federation protocols such as SAML, WSFederation, OAuth2 or OpenID Connect. A Federation configuration applies on a *Resource*(an application in this context). ## Configuration The following widgets must be configured to be able to configure the Federation and see the associated logs : * [Federation Widget](https://doc.memority.eu/configuration-guide/latest/federation-widget.md) : to see the *Federation* tab on a Resource allowing you to do the Federation configuration * [Federation Logs Widget](https://doc.memority.eu/configuration-guide/latest/federation-logs-widget.md) : to see the *Logs* tab on a Resource allowing you to see debug logs associated to this Federation configuration ![image-20240907-230620.png](https://doc.memority.eu/__attachments/a_50a1923fd3a0fdc70387777fb36dd373a839649f0583e2294d756dcc29016305/image-20240907-230620.png?cb=696e16f7ab302a5cdc6c081c75356b4a) ## Usage ### Create and update a Federation You can create a Federation configuration on a *Resource*by clicking on the Create button of the desired type of federation (SAML, WSFED or OAuth2/OIDC) in the "Federation" tab, or by duplicating an existing Federation configuration. ![image-20260625-163201.png](https://doc.memority.eu/__attachments/a_035ce9222268c0305318323242b8b78f8cebbed78352cbd953c35f69728eb633/image-20260625-163201.png?cb=2844d8f379599b6baab57a435820c13b) You can update a Federation configuration on a *Resource*in the "Federation" tab by clicking on the "Copy to next version" button. ![image-20240907-225721.png](https://doc.memority.eu/__attachments/a_e275f1d86acc89bdf77ddd0b0b07dd88d390c7c8122c430c6c80fd451c65837c/image-20240907-225721.png?cb=764c367e957481ce5c114c07d7c2062b) #### SAML Federation ![image-20260611-081149.png](https://doc.memority.eu/__attachments/a_839f5ef5c95c6974115d26a937224fa6226dba2a2e40810d42f8485619cd2552/image-20260611-081149.png?cb=6a0f6cdf37129c953bdb70061479f526) *Configuration screen of a SAML federation* The following properties should be filled for a Federation of type SAML : | **Property name** | **Mandatory** | **Description** | **Comments** | |---------------------------------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Service Provider Metadata File | NO | Metadata file of the Service Provider. | If provided, data contained in the metadata file will be used to pre-fill some Federation properties (SP entityID, ACS URL, ...). | | SP Entity Id | YES | The EntityID of the Service Provider. | May be imposed by the Service Provider. | | Assertion Consumer Urls | YES | The SP Url that will consume the SAML assertion. | Several Assertion Consumer Urls can be configured. It is recommanded that these URLs be in HTTPS. | | SP Logout Url | YES when "Enable SAML Logout" is enabled. | The logout URL is the application endpoint that receives logout responses during a SAML Single Logout use case. The binding (GET or POST) determines how the requests/responses are transmitted. | - | | Authentication Level | YES | The authentication level required to access the application. | Only authentication levels declared in [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings) are available in the list. | | Name Id | YES | Value sent as NameID in the SAML assertion. | Can be a [user attribute](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), an [Attribute Function](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md) or a constant. Click on the icon to select the good type. | | Name Id Format | YES | Format of the NameID sent in the SAML assertion. | Choose the one supported by the Service Provider. | | Additional attributes | NO | User attributes to be sent in the SAML assertion. | Can be [user attributes](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), [Attribute Functions](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md) or constants. Click on the icon to select the good type. | | Access control | NO | When enabled, only users having the right *app.access.\*can access the application. | Disabled by default. | | Enable SAML logout | NO | When enabled, SAML logout requests/responses can be used to logged out users. | Disabled by default. | | Idp logout Url | NO | Customized IdP logout Url used to terminate the user SSO session. | Default value is "https://`AM_URL`/sso/UI/Logout?realm=`tenant`" | | Idp Certificate | YES | Certificate used to sign the SAML assertion sent by the IdP. | Only certificates configured for the tenant are available in the list. A default signing certificate for SAML federations can be declared in [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings). If the certificate has expired, an alert message is displayed at the top of the screen, as shown below: ![image-20260317-155350.png](https://doc.memority.eu/__attachments/a_1ab7e98901b7c3fbf188ac34d1c4b792cbbc8f4b9aa9c83a62f4467486fb7984/image-20260317-155350.png?cb=3585215a73dd9f3430267cf1bb02845f) The expiration period can be configured in the [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings). | | Sign the SAML authentication request | NO | Indicate if the SAML request signature is required and must be verified. | Disabled by default. | | Sign the entire SAML Response | NO | To sign the entire SAML response and not only the SAML assertion. | Disabled by default. | | Sign the SAML logout request/response | NO | When enabled, SAML logout requests and reponses will be signed. | Disabled by default. | | SP signing certificate | YES | Appears when "Sign the SAML authentication request" or/and "Sign the SAML logout request/response" are set to ON. Certificate public key of the Service Provider in PEM format. Used to verify the SAML request signature. | Not displayed by default. ![image-20260518-154314.png](https://doc.memority.eu/__attachments/a_1b26f3782442a03dfce71341838335dfb779d38ede12f1a61a869fe8a8e67757/image-20260518-154314.png?cb=96118c2a1c8479f2c1a93b2107bc3292) | #### WSFED Federation ![image-20250217-222117.png](https://doc.memority.eu/__attachments/a_5d7a6a27ffdbe70f9e7ab664a8794c1f158fc514498b94311a5f545c6f9e9832/image-20250217-222117.png?cb=63a8f02fcfe4b83c476910678f6adaea) *Configuration screen of a WSFed Federation* The following properties should be filled for a Federation of type WS-Federation : | **Property name** | **Mandatory** | **Description** | **Comments** | |--------------------------------|---------------|---------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Service Provider Metadata File | NO | Metadata file of the Service Provider. | If provided, data contained in the metadata file will be used to pre-fill some Federation properties (SP entityID, ACS URL, ...). | | Realm | YES | Unique identifier of the Relying Party. | May be imposed by the Relying Party. | | Assertion Consumer Urls | YES | The SP Url that will consume the WSFederation assertion. | Several Assertion Consumer Urls can be configured. It is recommanded that these URLs be in HTTPS. | | Authentication Level | YES | The authentication level required to access the application. | Only authentication levels declared in [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings) are available in the list. | | Name Id | YES | Value sent as NameID in the WSFederation assertion. | Can be a [user attribute](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), an [Attribute Function](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md) or a constant. Click on the icon to select the good type. | | Name Id Format | YES | Format of the NameID sent in the WSFederation assertion. | Choose the one supported by the Service Provider. | | Additional attributes | NO | User attributes to be sent in the WSFederation assertion. | Can be [user attributes](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), [Attribute Functions](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md) or constants. Click on the icon to select the good type. | | Access control | NO | When enabled, only users having the right *app.access.\*can access the application. | Disabled by default. | | Certificate | YES | Certificate used to sign the WSFederation assertion. | Only certificates configured for the tenant are available in the list. A default signing certificate for SAML federations can be declared in [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings). If the certificate has expired, an alert message is displayed at the top of the screen, as shown below: ![image-20260317-155449.png](https://doc.memority.eu/__attachments/a_e046f4442ff8043d0dcdd65d4076b0e30eccaf73f9fd0a144698fdd26ad58ab7/image-20260317-155449.png?cb=3585215a73dd9f3430267cf1bb02845f) The expiration period can be configured in the [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings). | #### OAuth2/OIDC Federation ![image-20260917-161800.png](https://doc.memority.eu/__attachments/a_98f5f49c3131a92cf4d63b558d2ee29783c50cc2f6ae5752ec358d98a9cb87f3/image-20260917-161800.png?cb=a3536846eb93e14c0a1a3dc5b8e0a841) ![image-20260917-161826.png](https://doc.memority.eu/__attachments/a_3a1d3db538a492b720e1e7adee6b2c5597055c846ded1fa7a8e3c87ee4b35b4d/image-20260917-161826.png?cb=eacde03575880ff93c5e566998617375) The following properties should be filled for a Federation of type OAuth2/OIDC : | **Property name** | **Mandatory** | **Description** | **Comments** | |--------------------------------------------------------|------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Client Id | YES | Unique identifier of the OAuth2/OIDC client application. | May be imposed by the client application. | | Redirect Uri | YES | The application Uri that will receive the OAuth2/OIDC tokens. Should be an URL or an URN. | - | | Client Type | YES | The OAuth2/OIDC client type. | Must be `Confidential` or `Public`. | | Client Secret | YES | The client secret associated to the Client Id. | Only required for `Confidential` clients. | | Jwks Url | NO | URL of the client's public keys, used to check the signature of `id_token_hint`. | - | | Authentication Level | YES | The authentication level required to access the client application. | Only authentication levels declared in [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings) are available in the list. | | Subject | YES | Attribute value sent as Subject in the id token. Only available for an OpenID Connect application. | Can be a [user attribute](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), an [Attribute Function](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md) or a constant. Click on the icon to select the good type. | | Access token in JWT format | NO | When enabled, the access token generated for the client will be in JWT format | - | | Includes claims in JWT access token | NO | When enabled, the user claims will be added in the JWT access token | Can only be enabled if "Access token in JWT format" is enabled | | OpenID Connect Application | NO | Indicates if the application is an OpenID Connect application. | Set it to ON for an OpenID Connect application and to OFF for a simple OAuth2 application. | | Include claims in id token | NO | To include all configured scopes in the id token. Only available for an OpenID Connect application. | - | | Custom Scopes | NO | User attributes returned as scopes. Check the box next to the scope to define it as default scope. Default scopes are returned in the authorization response if no scope is requested by the application. | Can be [user attributes](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), [Attribute Functions](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md), constants or claims. Click on the icon to select the good type. | | Standard Scopes | NO | Specific list with "profile", "address", "email", "phone". Specific predefined user attributes returned as scopes. Check the box next to the scope to define it as default scope. Default scopes are returned in the authorization response if no scope is requested by the application. | Only displayed if "OpenID Connect application" is ON. If a value is selected, it won't be available in custom scopes list. Custom scopes and standard scopes can't have the same name. | | Claims | NO | Claims that can be associated with a scope. | Can be [user attributes](https://doc.memority.eu/configuration-guide/latest/access-attributes.md), [Attribute Functions](https://doc.memority.eu/configuration-guide/latest/attribute-functions.md) or static value. Click on the icon to select the good type. | | AMR - Enabled | NO | When enabled, the AMR toggle displays configuration field for AMR values. | Disabled by default. | | AMR - Name | NO | Define the AMR claim value that will be included in the ID token for the selected authentication method. | | | AMR - Modules | YES if the Name field is provided. | Select the authentication method associated with this AMR claim value. | | | Certificate | NO | Certificate used to sign JWT tokens. | Only certificates configured for the tenant are available in the list. The default signing certificate is the one configured on the OAuth2 global configuration in the Memority admin portal. If the certificate has expired, an alert message is displayed at the top of the screen, as shown below: ![image-20260317-155449.png](https://doc.memority.eu/__attachments/a_e046f4442ff8043d0dcdd65d4076b0e30eccaf73f9fd0a144698fdd26ad58ab7/image-20260317-155449.png?cb=3585215a73dd9f3430267cf1bb02845f) The expiration period can be configured in the [settings](https://doc.memority.eu/configuration-guide/latest/federation-widget.md#Settings). | | Post logout redirect Uris | NO | Configures the authorized URIs to which the user is redirected after logout. Should be an URL or an URN | - | | Propagate 'sub' from id_token_hint | NO \* | When enabled, the 'sub' claim received in the id_token_hint is returned unchanged in the issued id_token. | Required for EntraID External MFA. | | Username claim from id_token_hint | NO | Defines the claim extracted from the id_token_hint to pre-fill the user login field. | Default value is 'sub'. | | Tokens Lifetime - Enabled | NO | When enabled, the token lifetime toggle displays configuration fields for OAuth2/OIDC tokens, allowing to define custom expiration durations. | - | | Tokens Lifetime - Access Token | NO | Configuration related to access token. | - | | Tokens Lifetime - Refresh Token | NO | Configuration related to refresh token. | Not displayed when refresh tokens are disabled for the tenant in the OAuth2 configuration within the admin portal. | | Tokens Lifetime - Authorization Code | NO | Configuration related to authorization token. | - | | Tokens Lifetime - Id Token | NO | Configuration related to id token. | Not displayed when "OpenID Connect application" is set to OFF. | | Authorized Flows - Authorization Code | NO | Enable the Authorization Code flow for this application. | Enabled by default. | | Authorized Flows - Implicit | NO | Enable the Implicit flow for this application. | Enabled by default. | | Authorized Flows - Resource Owner Password Credentials | NO | Enable the Resource Owner Password Credentials flow for this application. | Enabled by default. | | Authorized Flows - Client credentials | NO | Enable the Client credentials flow for this application. | Enabled by default. | | Authorized Flows - Refresh Token | NO | Enable the Refresh Token flow for this application. | Enabled by default. | | Authorized Flows - JWT Bearer | NO | Enable the JWT Bearer flow for this application. | Enabled by default. | | Authorized Flows - Device Authorization Grant | NO | Enable the Device Authorization Grant for this application. | Enabled by default. | #### Copy an existing Federation ![image-20260625-163238.png](https://doc.memority.eu/__attachments/a_547a904303e28688670ea68cecb46bc52f0ae6f1ae44a7686a3793a4a3dc1b7c/image-20260625-163238.png?cb=7e6edc0f2f6fed06ec732bff522db521) You can duplicate an existing federation configuration by clicking on the "Copy Existing Federation" button in the "Federation" tab. A list of Resources with configured federation settings is displayed. Choose the Resource whose federation configuration you want to copy. After the copy operation, the federation configuration form is displayed with the copied settings already filled in. Some properties are not copied and must be completed manually. ##### Copy a SAML Federation The following properties should be filled for a Federation of type SAML : * SP Entity Id * ACS URLs * SP Logout URL if "Enable SAML Logout" is enabled ##### Copy a WSFED Federation The following properties should be filled for a Federation of type WSFED : * Realm * ACS URLs ##### Copy an OAuth2/OIDC Federation The following properties should be filled for a Federation of type OAuth2/OIDC : * Client ID * Client secret * Redirect URIs * Post logout Redirect URIs ### Read a Federation You can consult a Federation on a *Resource*by clicking on the "Federation" tab. ![image-20240907-225655.png](https://doc.memority.eu/__attachments/a_2d84475e88c348485dabc41085fab8c5c743a77e9b5431fa4caf866dd0744265/image-20240907-225655.png?cb=cae25427267414213b9961268f290166) ### Undeploy a Federation You can undeploy a Federation on a Resource by clicking on the "Undeploy" button in the "Federation" tab. When undeployed, the Federation is *still*visible in the Memority portal but can not be used anymore. ![image-20240907-225522.png](https://doc.memority.eu/__attachments/a_177acbd6701b7a425f8c9534911c3162b449382985b1e1dc901592c6cb865395/image-20240907-225522.png?cb=c8bd579c20a2fde15a04b7575d74beb0) ### Understand Federation statuses A Federation can have 3 different statuses that apply to its **CURRENT**Version : ![image-20240907-225400.png](https://doc.memority.eu/__attachments/a_eb255884e4bfc68a0ba4fe57ddbe87cc5d7982c214d793a56b4f949fe0a163c6/image-20240907-225400.png?cb=2afdce3f27c91e390ea02d557e0dca3f) * **Deployed**: The Federation of an enabled Resource is deployed on Memority and is ready to use. * **To be deployed** : The Federation is not deployed on Memority as the Resource is disabled. Will automatically become deployed after enabling the Resource. * **Not deployed** : The Federation is not deployed on Memority and cannot be used. The following diagram explains how a Federation can reach these 3 statuses : ![image-20240206-133809.png](https://doc.memority.eu/__attachments/a_9fc87462990bfcf18cb2a63ecab87523a3477cf21a8d039f62d54beedfc68544/image-20240206-133809.png?cb=3e76222f0b2d636c3eb32865e6cc446d) ### Get the Memority configuration for a Federation #### OAuth2/OIDC Federation You can view Memority OAuth2/OpenID Connect endpoints by clicking on the "Show oauth2 endpoints" button on the OAuth2/OIDC Federation. ![image-20240907-225250.png](https://doc.memority.eu/__attachments/a_291d36c573b7528783b2337ad871015ec575d82a4b8da06538182270275720ef/image-20240907-225250.png?cb=c29f81fdfb0950023c2b4fbe817ac84b) ![image-20240223-153357.png](https://doc.memority.eu/__attachments/a_762cf357da8a429b9904f0698242974d4ca77daba42690a81967db1182a96979/image-20240223-153357.png?cb=fb47da5e36185154ccd89c8d3c854594) #### SAML/WSFED Federation You can get the Memority IdP metadata on the SAML/WSFED Federation : * by downloading the metadata file when clicking on the left part of the "Idp metadata" button * by copying the IdP metadata URL when clicking on the rigth part of the "Idp metadata" button (copy icon) ![image-20260401-121338.png](https://doc.memority.eu/__attachments/a_22f589a2374f0969938865a65404c2a9363f40395a87f5f30b3c6d662ff47f99/image-20260401-121338.png?cb=66810c3e5435c1b43955e2faa5384096) ### Test the configuration Only for SAML and WSFederation applications. Once the federation configuration is successfully deployed, you can test it in "IdP-initiated" mode by clicking on the "Open test URL" button. ![image-20240907-225105.png](https://doc.memority.eu/__attachments/a_49edd7b1baf0b10e98a9f2e76b890f4dd89d2d5b2766b174bb98f1c3de040e87/image-20240907-225105.png?cb=ffe232a9ee481186c11ffccb9d4c771e) ### Debug logs Debug logs related to a Federation configuration are available through the *Logs*tab on the Resource. See [Federation Logs Widget](https://doc.memority.eu/configuration-guide/latest/federation-logs-widget.md) to configure federation debug logs. ## Reporting All Federations configurations are provisioned to a [Federation Mongo collection](https://doc.memority.eu/configuration-guide/latest/reporting-object-configurations.md#FEDERATION). It allows you to see all modifications done on the Federation or to identify all applications using a specific Attributes Function for example. ## Read Next