It lets students and researchers sign in through their home institution's IdP without your application trusting each institution individually. Authdog fronts it as a first-class enterprise SAML connector. For institutions that publish their IdP metadata through eduGAIN, the generic SAML 2.0 connector also works. Use the RENATER connector when you want a connection labeled and documented as RENATER in the console.
Copy the service-provider values
In the Authdog console, select the project and environment, find RENATER (the Federation filter is pre-selected by this link), and click Enable. Authdog displays:
- SP-initiated sign-in URL
- ACS / Reply URL
- SP Entity ID / audience
- Downloadable SP metadata XML
Register with RENATER
RENATER federates institution IdPs through a metadata aggregate that your SP trusts.
- Register your SP with the RENATER federation operator and sign the federation policy.
- Provide Authdog's SP entity ID, ACS URL, and SP metadata. RENATER lists your SP in its metadata aggregate.
- The operator returns the metadata URL for the federation aggregate (or a specific IdP's metadata, if you scope the connection to one institution).
Configure Authdog
| Field | Value |
|---|---|
| Connection name | A label that identifies this RENATER connection, e.g. renater-prod |
| IdP SSO URL | The SAML SSO URL from the federation metadata |
| IdP X.509 certificate | The signing certificate from the federation metadata |
| IdP Entity ID | The entity ID from the federation metadata |
| Email domains | The discovery domains that should route to this connection, e.g. etu-example.fr, univ-example.fr |
Save, then toggle the connection active.
For a multi-institution connection, prefer importing the federation metadata URL so certificate rotations are picked up when you re-fetch. For a single-institution connection, pin the certificate and rotate it manually.
What RENATER returns
Authdog reads the SAML subject and the eduPerson-scoped attributes the institution IdP releases, including eduPersonPrincipalName, eduPersonAffiliation, mail, and displayName. The exact attributes depend on the institution's attribute release policy; map them to profile fields in the connection form.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select the RENATER button and pick your institution on the discovery service (WAYF) if prompted.
- Complete the flow on your institution IdP.
- Confirm the user appears under Users in the console with a RENATER identity linked.
Troubleshooting
| Symptom | Cause |
|---|---|
No response / signature error |
The federation metadata is stale; re-fetch the metadata URL to pick up a rotated certificate |
Missing eduPersonPrincipalName |
The institution did not release the attribute to your SP |
| WAYF shows no institutions | Your SP is not yet registered in the federation aggregate |
| Works for one institution only | You pinned a single IdP instead of the federation aggregate |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| Enterprise SSO | Connect any SAML or OIDC enterprise identity provider |