Federation connectors
A federation connector is your organization’s own external OIDC or SAML identity provider, registered with Sudomimus once and reused everywhere. If your company runs Microsoft Entra ID, Okta, Google Workspace, Ping, Auth0, or another standards-compliant provider, you register it as a connector and then either:
- offer it as a “Sign in with …” button on one of your applications (application-managed), or
- force a verified domain’s users through it (domain-managed / forced SSO).
The connector is the shared mount point for both. Sudomimus acts as an OIDC relying party or SAML service provider against your IdP. Your provider stays the source of truth for those identities.
What a connector stores
Section titled “What a connector stores”You register a connector from the With portal on one of your organizations. Every connector has a display name and immutable protocol. Its remaining fields depend on that protocol.
| Field | What it is |
|---|---|
| Display name | Shown on the login button and in management UIs (e.g. “Acme Corp SSO”). |
| Issuer | Your IdP’s issuer URL (https://login.acme.example). Sudomimus fetches its OIDC discovery document from <issuer>/.well-known/openid-configuration. |
| Client ID | The OAuth client ID Sudomimus presents to your IdP. |
| Client secret | The confidential client secret. Encrypted at rest and write-only — see below. |
| Scopes | The scopes Sudomimus requests; must include openid. |
Each connector is addressed by an opaque connector anchor (a value like Bastion-K7Q2-M9XB-3FNP-Covenant) — the developer-facing identifier you reference from rules and policies.
The client secret is never revealed back to you
Section titled “The client secret is never revealed back to you”The client secret is encrypted the moment you save it. On every read — the connector list, the detail page, the API — it is simply absent: the portal can never display it back to you. To rotate it, supply a new secret; to keep the existing one when editing other fields, leave the secret blank.
| Field | What it is |
|---|---|
| IdP entity ID | The exact issuer Sudomimus accepts in SAML assertions. |
| IdP SSO URL | The HTTPS endpoint that receives SP-initiated AuthnRequests. |
| Signing certificates | One or more IdP signing certificates. Keep both old and new certificates during a rollover window. |
| Subject source | Either assertion NameID or one named attribute. This is immutable because it defines the external credential identity. |
| Profile attributes | Optional attribute names for email, given name, and family name. |
The connector detail page shows Sudomimus’s fixed SP entity ID and Assertion Consumer Service (ACS) URL. Register both values at your IdP. SAML connectors have no client secret.
The supported profile is SAML 2.0 SP-initiated browser SSO: HTTP-Redirect AuthnRequest, HTTP-POST response, and a signed assertion. IdP-initiated SSO, encrypted assertions, Single Logout, metadata import, and signed AuthnRequests are not currently supported.
Setup guides
Section titled “Setup guides”Validation at save time
Section titled “Validation at save time”When you create or update an OIDC connector, Sudomimus fetches your IdP’s discovery document then and there. If the issuer is unreachable or invalid, the save is rejected (FederationConnectorDiscoveryFailed). SAML configuration is structurally validated at save time; assertion signatures and profile constraints are checked at every login.
OIDC redirect URI
Section titled “OIDC redirect URI”Sudomimus uses a single, platform-fixed redirect (callback) URI for all connectors — your IdP distinguishes flows by the per-login state value, not by the redirect URI. The connector page shows this URI read-only; register it as an allowed redirect URI in your IdP’s application configuration:
https://federation.sudomimus.com/oidc/callbackManaging connectors
Section titled “Managing connectors”- Disable a connector to retire it without deleting it — useful when you are migrating IdPs.
- Delete removes it entirely.
Each organization can hold a limited number of connectors (default 3). Sudomimus staff can raise the limit on request. The quota is enforced on the self-service surface only.
Browsing connectors
Section titled “Browsing connectors”The With portal has a top-level Connectors view that lists every connector across all your organizations, with an organization switcher.