Skip to content

Federation connectors

View as Markdown

A federation connector is your organization’s own external OIDC or SAML identity provider, registered with Sudomimus once and reused everywhere. If your company runs Microsoft Entra ID, Okta, Google Workspace, Ping, Auth0, or another standards-compliant provider, you register it as a connector and then either:

The connector is the shared mount point for both. Sudomimus acts as an OIDC relying party or SAML service provider against your IdP. Your provider stays the source of truth for those identities.

You register a connector from the With portal on one of your organizations. Every connector has a display name and immutable protocol. Its remaining fields depend on that protocol.

FieldWhat it is
Display nameShown on the login button and in management UIs (e.g. “Acme Corp SSO”).
IssuerYour IdP’s issuer URL (https://login.acme.example). Sudomimus fetches its OIDC discovery document from <issuer>/.well-known/openid-configuration.
Client IDThe OAuth client ID Sudomimus presents to your IdP.
Client secretThe confidential client secret. Encrypted at rest and write-only — see below.
ScopesThe scopes Sudomimus requests; must include openid.

Each connector is addressed by an opaque connector anchor (a value like Bastion-K7Q2-M9XB-3FNP-Covenant) — the developer-facing identifier you reference from rules and policies.

The client secret is never revealed back to you

Section titled “The client secret is never revealed back to you”

The client secret is encrypted the moment you save it. On every read — the connector list, the detail page, the API — it is simply absent: the portal can never display it back to you. To rotate it, supply a new secret; to keep the existing one when editing other fields, leave the secret blank.

FieldWhat it is
IdP entity IDThe exact issuer Sudomimus accepts in SAML assertions.
IdP SSO URLThe HTTPS endpoint that receives SP-initiated AuthnRequests.
Signing certificatesOne or more IdP signing certificates. Keep both old and new certificates during a rollover window.
Subject sourceEither assertion NameID or one named attribute. This is immutable because it defines the external credential identity.
Profile attributesOptional attribute names for email, given name, and family name.

The connector detail page shows Sudomimus’s fixed SP entity ID and Assertion Consumer Service (ACS) URL. Register both values at your IdP. SAML connectors have no client secret.

The supported profile is SAML 2.0 SP-initiated browser SSO: HTTP-Redirect AuthnRequest, HTTP-POST response, and a signed assertion. IdP-initiated SSO, encrypted assertions, Single Logout, metadata import, and signed AuthnRequests are not currently supported.

When you create or update an OIDC connector, Sudomimus fetches your IdP’s discovery document then and there. If the issuer is unreachable or invalid, the save is rejected (FederationConnectorDiscoveryFailed). SAML configuration is structurally validated at save time; assertion signatures and profile constraints are checked at every login.

Sudomimus uses a single, platform-fixed redirect (callback) URI for all connectors — your IdP distinguishes flows by the per-login state value, not by the redirect URI. The connector page shows this URI read-only; register it as an allowed redirect URI in your IdP’s application configuration:

https://federation.sudomimus.com/oidc/callback
  • Disable a connector to retire it without deleting it — useful when you are migrating IdPs.
  • Delete removes it entirely.

Each organization can hold a limited number of connectors (default 3). Sudomimus staff can raise the limit on request. The quota is enforced on the self-service surface only.

The With portal has a top-level Connectors view that lists every connector across all your organizations, with an organization switcher.