> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Federated SAML

> Connect anny to your identity federation (e.g. DFN-AAI or eduGAIN) so users can log in through a shared network.

Federated SAML is used when your organization is part of a larger identity network (e.g. in higher education via DFN-AAI or eduGAIN). Instead of setting up a manual 1:1 connection, anny and your identity provider communicate through this shared federation. The initial setup is proactively triggered by anny.

## Who is this feature for?

This setup is aimed at IT admins of:

* Universities and colleges that authenticate through national research networks.
* Large corporations with a central federation for multiple subsidiaries.

## How the setup works

The process consists of two phases: creating the connection in anny and approving it in your system.

<Steps>
  <Step title="Trigger the connection in anny">
    1. In anny, open the **Account settings** and switch to the **SSO & Security** area.
    2. Click the **+ Add IdP** button.
    3. Select the **Federation** option and then click your network (e.g. **DFN-AAI**).
    4. Now enter your organization's **Entity ID**. **Tip:** If you use DFN-AAI, you find your Entity ID in the [**DFN-AAI tool overview**](https://tools.aai.dfn.de/entities/). Select the "Identity Provider" area there, search for your organization, copy the "SAML Entity ID", and insert it in anny.
    5. Save the entry in anny. This sends a proactive request to your federation.

           <img src="https://mintcdn.com/anny-85c98540/WI0eDTofsGdW2lVL/images/image-2.png?fit=max&auto=format&n=WI0eDTofsGdW2lVL&q=85&s=dfde7439c3bd1c70db7339534a8fdb2a" alt="Image" width="2072" height="1166" data-path="images/image-2.png" />
  </Step>

  <Step title="Approval in the federation interface">
    Now switch to the management system of your identity federation to process the request from anny.

    1. **Check the request in the interface** As soon as you have triggered the connection in anny, you receive a request from anny on your side (in your federation interface). This request contains anny's specific Entity ID.
    2. **Note the domain and accept** Check the Entity ID. **Important:** Pay close attention to the domain ending here! Depending on which server your anny account is on, the domain of the Entity ID is either **anny.eu** or **anny.co**. Accept the request for the exactly matching domain in your interface.
    3. **Create and release attributes** The login is now linked. For anny to create a real user profile from the login, data must be passed during authentication. Create the following attributes on your side and explicitly release them for anny (attribute release):

    * **Email (Required)** `urn:oid:1.2.840.113549.1.9.1` or `urn:oid:0.9.2342.19200300.100.1.3`
    * **First and last name (Required)** `givenName` (`urn:oid:2.5.4.42`) and `surname` (`urn:oid:2.5.4.4`)
    * **Name (Fallback)** If first and last name cannot be passed separately by your system, use the `displayName` (`urn:oid:2.16.840.1.113730.3.1.241`) as an alternative.

    Your users can now log in to anny through the federation. The released attributes are passed during login and can additionally be used in anny for **attribute mapping**, to route people automatically into the right booking areas (communities).
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Users can log in but have empty profiles in anny">
    This means the login works, but your federation is not sending any attributes to anny. Check in your interface whether you have actually released the attributes (such as email or name) for the anny application.
  </Accordion>

  <Accordion title="The request is not found">
    Make sure you search for the exact Entity ID in the interface, and confirm with anny Support whether the request was made for **.eu** or **.co**.
  </Accordion>
</AccordionGroup>