What is SAML 2.0 federation in ForgeRock AM and how do you configure a Service Provider?

SAML 2.0 (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). ForgeRock AM supports SAML 2.0 as both IdP and SP, making it suitable for B2B federation, connecting enterprise applications, and participating in identity federations like InCommon or eIDAS.

In a SAML 2.0 flow where AM acts as IdP:

1. User accesses the SP (e.g., Salesforce, ServiceNow).
2. SP sends an AuthnRequest to AM's SSO service endpoint.
3. AM authenticates the user (via an authentication tree).
4. AM issues a signed SAML Assertion containing the user's identity attributes.
5. AM POSTs the assertion (wrapped in a SAMLResponse) to the SP's Assertion Consumer Service (ACS) URL.
6. SP validates the signature using AM's public key from its metadata and creates a session.

Configuring a Service Provider in AM (IdP-side circle of trust):

• Obtain the SP's SAML2 metadata XML — contains entityID, ACS URL, signing certificates, and name ID formats.
• In AM console, navigate to the realm → Federation → Entity Providers → Import Entity. Paste or upload the metadata XML.
• Create or add to a Circle of Trust (CoT) that includes both the AM IdP entity and the imported SP entity.
• Configure the SP's attribute mapping — define which AM user attributes map to which SAML attributes in the assertion.
• Optionally configure the name ID format — persistent, transient, or email address.

For AM acting as SP (consuming assertions from an external IdP like Azure AD or Okta), the process is reversed — you import the IdP's metadata and configure how incoming assertions are mapped to AM session attributes.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.