中文
devexamples
← Workflows

阅读中文版本

Identity Federation Onboarding Workflow

Exchange metadata with the identity provider, map claims to roles, test in a sandbox, and roll out federation with a fallback for break-glass access.

advanced~150 minidentityssosecurity

Objective

Connect an external identity provider so users sign in with federated identities and receive correct roles.

Environment

  • The IdP metadata and an SP implementation
  • A test tenant for validation

Steps

1. Exchange and validate metadata and certificates

Exchange and validate metadata and certificates with the IdP.

Expected state: Trust is established in both directions.

2. Map IdP claims to application roles

Map IdP claims to application roles and groups.

Expected state: Users get the intended authorization.

3. Test the full login and logout

Test the full login and logout flow with a pilot group.

Expected state: The flow works before broad release.

4. Roll out to all users

Roll out to all users and keep a break-glass local admin.

Expected state: Federation does not create a lockout risk.

Decision points

Force federation for everyone?

  • Yes, with break-glass
  • Allow local login too

Force federation plus a monitored break-glass account; open local login is a shadow path that bypasses IdP controls.

JIT provisioning or pre-provision?

  • Just-in-time
  • Pre-provision from SCIM

JIT for fast onboarding; SCIM when you need deprovisioning and group sync to be authoritative.

Expected outcome

Users authenticate through the IdP with correctly mapped roles, and a break-glass path exists for IdP outages.

Verification

Confirm pilot users complete login, receive expected roles, and that the break-glass account is excluded from federation-only enforcement.

Cleanup

Record the metadata versions and ship the role-mapping documentation.

Overview

Connect an external identity provider so users sign in with federated identities and receive correct roles. Confirm pilot users complete login, receive expected roles, and that the break-glass account is excluded from federation-only enforcement.

Steps

  1. Exchange and validate metadata and certificates with the IdP. Expected state: Trust is established in both directions.
  2. Map IdP claims to application roles and groups. Expected state: Users get the intended authorization.
  3. Test the full login and logout flow with a pilot group. Expected state: The flow works before broad release.
  4. Roll out to all users and keep a break-glass local admin. Expected state: Federation does not create a lockout risk.
<EntityDescriptor entityID="https://idp.example.com">
  <IDPSSODescriptor>
    <KeyDescriptor use="signing"><KeyInfo>...</KeyInfo></KeyDescriptor>
  </IDPSSODescriptor>
</EntityDescriptor>

Verification

  • Users authenticate through the IdP with correctly mapped roles, and a break-glass path exists for IdP outages.

Decision points

  • Force federation for everyone? Options: Yes, with break-glass; Allow local login too. Recommended: Force federation plus a monitored break-glass account; open local login is a shadow path that bypasses IdP controls.
  • JIT provisioning or pre-provision? Options: Just-in-time; Pre-provision from SCIM. Recommended: JIT for fast onboarding; SCIM when you need deprovisioning and group sync to be authoritative.