RENATER is the *Fédération Éducation-Recherche*, the SAML federation for higher education and research institutions across France. It lets students and researchers sign in through their home institution's IdP without your application trusting each institution individually. Authdog fronts it as a first-class enterprise SAML connector.

For institutions that publish their IdP metadata through eduGAIN, the generic **SAML 2.0** connector also works. Use the RENATER connector when you want a connection labeled and documented as RENATER in the console.

## Copy the service-provider values

In the [Authdog console](https://console.authdog.com/dashboard/authentication?tab=providers&category=federation), select the project and environment, find **RENATER** (the **Federation** filter is pre-selected by this link), and click **Enable**. Authdog displays:

- SP-initiated sign-in URL
- ACS / Reply URL
- SP Entity ID / audience
- Downloadable SP metadata XML

## Register with RENATER

RENATER federates institution IdPs through a metadata aggregate that your SP trusts.

1. Register your SP with the RENATER federation operator and sign the federation policy.
2. Provide Authdog's SP entity ID, ACS URL, and SP metadata. RENATER lists your SP in its metadata aggregate.
3. The operator returns the **metadata URL** for the federation aggregate (or a specific IdP's metadata, if you scope the connection to one institution).

## Configure Authdog

| Field | Value |
| --- | --- |
| **Connection name** | A label that identifies this RENATER connection, e.g. `renater-prod` |
| **IdP SSO URL** | The SAML SSO URL from the federation metadata |
| **IdP X.509 certificate** | The signing certificate from the federation metadata |
| **IdP Entity ID** | The entity ID from the federation metadata |
| **Email domains** | The discovery domains that should route to this connection, e.g. `etu-example.fr`, `univ-example.fr` |

Save, then toggle the connection **active**.

For a multi-institution connection, prefer importing the federation metadata URL so certificate rotations are picked up when you re-fetch. For a single-institution connection, pin the certificate and rotate it manually.

## What RENATER returns

Authdog reads the SAML subject and the eduPerson-scoped attributes the institution IdP releases, including `eduPersonPrincipalName`, `eduPersonAffiliation`, `mail`, and `displayName`. The exact attributes depend on the institution's attribute release policy; map them to profile fields in the connection form.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the RENATER button and pick your institution on the discovery service (WAYF) if prompted.
3. Complete the flow on your institution IdP.
4. Confirm the user appears under **Users** in the console with a RENATER identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `No response` / signature error | The federation metadata is stale; re-fetch the metadata URL to pick up a rotated certificate |
| Missing `eduPersonPrincipalName` | The institution did not release the attribute to your SP |
| WAYF shows no institutions | Your SP is not yet registered in the federation aggregate |
| Works for one institution only | You pinned a single IdP instead of the federation aggregate |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [Enterprise SSO](/docs/sso) | Connect any SAML or OIDC enterprise identity provider |