AAF (Annuaire Académique Fédéré) is the federated directory that backs it. Authdog fronts it as a first-class enterprise SAML connector, so one connection can serve staff across academies that federate through ARENA.
Copy the service-provider values
In the Authdog console, select the project and environment, find ARENA / AAF (the Federation filter is pre-selected by this link), and click Enable. Authdog displays:
- SP-initiated sign-in URL
- ACS / Reply URL
- SP Entity ID / audience
- Downloadable SP metadata XML
Register with the academy operator
ARENA / AAF access is provisioned by the academy or the federation operator for eligible education services.
- Request a SAML connection from the academy operator.
- Provide Authdog's SP entity ID, ACS URL, and SP metadata to the operator.
- The operator returns the IdP SSO URL, the IdP X.509 signing certificate, and the IdP entity ID.
If the operator publishes a metadata URL, you can import it directly into Authdog instead of pasting values by hand.
Configure Authdog
| Field | Value |
|---|---|
| Connection name | A label that identifies this ARENA / AAF connection, e.g. arena-aaf-prod |
| IdP SSO URL | The SAML SSO URL from the academy operator |
| IdP X.509 certificate | The signing certificate from the operator or metadata |
| IdP Entity ID | The entity ID from the operator or metadata |
| Email domains | The discovery domains that should route to this connection, e.g. ac-example.fr |
Save, then toggle the connection active.
What ARENA / AAF returns
Authdog reads the SAML subject and the email, name, and group claims the academy IdP releases. The exact claim names depend on the academy's attribute release policy; map them to profile fields in the connection form.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select the ARENA / AAF button and complete the flow on the academy IdP.
- Confirm the user appears under Users in the console with an ARENA / AAF identity linked.
Troubleshooting
| Symptom | Cause |
|---|---|
No response / signature error |
The IdP certificate in Authdog does not match the academy's current signing certificate |
| Missing email claim | The academy did not release the email attribute to your SP |
Invalid binding |
The operator requires a different SAML binding than the default |
| Works in one academy only | Each academy may run its own IdP; add a connection per academy |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| Enterprise SSO | Connect any SAML or OIDC enterprise identity provider |