ARENA / AAF is the SAML identity provider for teachers, administrators, and education staff managed by the French regional academies. AAF (Annuaire Académique Fédéré) is the federated directory that backs it. Authdog fronts it as a first-class enterprise SAML connector, so one connection can serve staff across academies that federate through ARENA.

## Copy the service-provider values

In the [Authdog console](https://console.authdog.com/dashboard/authentication?tab=providers&category=federation), select the project and environment, find **ARENA / AAF** (the **Federation** filter is pre-selected by this link), and click **Enable**. Authdog displays:

- SP-initiated sign-in URL
- ACS / Reply URL
- SP Entity ID / audience
- Downloadable SP metadata XML

## Register with the academy operator

ARENA / AAF access is provisioned by the academy or the federation operator for eligible education services.

1. Request a SAML connection from the academy operator.
2. Provide Authdog's SP entity ID, ACS URL, and SP metadata to the operator.
3. The operator returns the **IdP SSO URL**, the **IdP X.509 signing certificate**, and the **IdP entity ID**.

If the operator publishes a metadata URL, you can import it directly into Authdog instead of pasting values by hand.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Connection name** | A label that identifies this ARENA / AAF connection, e.g. `arena-aaf-prod` |
| **IdP SSO URL** | The SAML SSO URL from the academy operator |
| **IdP X.509 certificate** | The signing certificate from the operator or metadata |
| **IdP Entity ID** | The entity ID from the operator or metadata |
| **Email domains** | The discovery domains that should route to this connection, e.g. `ac-example.fr` |

Save, then toggle the connection **active**.

## What ARENA / AAF returns

Authdog reads the SAML subject and the email, name, and group claims the academy IdP releases. The exact claim names depend on the academy's attribute release policy; map them to profile fields in the connection form.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the ARENA / AAF button and complete the flow on the academy IdP.
3. Confirm the user appears under **Users** in the console with an ARENA / AAF identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `No response` / signature error | The IdP certificate in Authdog does not match the academy's current signing certificate |
| Missing email claim | The academy did not release the email attribute to your SP |
| `Invalid binding` | The operator requires a different SAML binding than the default |
| Works in one academy only | Each academy may run its own IdP; add a connection per academy |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [Enterprise SSO](/docs/sso) | Connect any SAML or OIDC enterprise identity provider |