French education and research identity federations

French schools, academies, and research institutions already have national identity systems. Connecting an Authdog app to those systems used to mean treating them as generic SAML or OpenID Connect IdPs and reconstructing the setup by hand.

Authdog now ships first-class connectors for ÉduConnect, FranceConnect, ARENA / AAF, and RENATER. They use the same enterprise SSO connection model as Okta or Entra ID: configure once in the console, then the hosted Account Portal and your apps can route users to the right federation.

This is the longer note behind the September 1 changelog entry.

Why these federations

France does not have one education identity. Students and parents, teachers, and researchers sit in different national systems:

• ÉduConnect (OIDC) — primary and secondary students and parents signing into school portals (ENT)
• FranceConnect (OIDC) — the government identity aggregator, often used by parents
• ARENA / AAF (SAML) — teachers, administrators, and academy staff
• RENATER (SAML) — the Fédération Éducation-Recherche for higher education and research

A campus or EdTech product often needs more than one of these. Named connectors keep each federation visible in the console instead of four anonymous generic connections.

How it works

Each connector is a named providerId on an environment connection. Authdog maps it to the protocol the identity service already implements:

• ÉduConnect and FranceConnect run through the existing OIDC authorization-code handlers
• ARENA / AAF and RENATER run through the existing SAML 2.0 handlers

Sign-in, callback, metadata import, and certificate handling are the same as other enterprise SSO. What changed is the catalog: logos, labels, console forms, and documentation so operators pick the federation they actually use.

Users reach the connection through email-domain discovery on the hosted Account Portal. An address on a configured domain is routed to the matching active connection.

Set up a connection

In the Authdog console, open Authentication > Providers, filter to Enterprise, and choose the federation:

1. Copy Authdog's service-provider values into the IdP (callback URL for OIDC; ACS, Entity ID, and metadata for SAML).
2. Enter the IdP values in Authdog (discovery URL and client credentials for OIDC; SSO URL and signing certificate, or metadata import, for SAML).
3. Add the email domains that should discover this connection.
4. Save, then use Test before inviting users.

Multiple connections of the same provider are allowed. Keep discovery domains non-overlapping so routing stays deterministic.

Trust boundaries

Authdog trusts the IdP you configure. Pin SAML trust to the academy or RENATER certificate you imported. Store OIDC client secrets only in Authdog and the IdP. Federation proves who the IdP says the user is; your app still has to create a session and enforce authorization.

Institutional IdPs under RENATER or eduGAIN can still use the generic SAML 2.0 connector. eduroam is a network access service, not a web SSO provider, so it is not in the catalog.

Try it

Setup details live in the SSO documentation. The original release note is in the changelog.