What is SAML 2.0 federation in ForgeRock AM and how do you configure a Service Provider?

SAML 2.0 (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). ForgeRock AM supports SAML 2.0 as both IdP and SP, making it suitable for B2B federation, connecting enterprise applications, and participating in identity federations like InCommon or eIDAS.

In a SAML 2.0 flow where AM acts as IdP:

1. User accesses the SP (e.g., Salesforce, ServiceNow).
2. SP sends an AuthnRequest to AM's SSO service endpoint.
3. AM authenticates the user (via an authentication tree).
4. AM issues a signed SAML Assertion containing the user's identity attributes.
5. AM POSTs the assertion (wrapped in a SAMLResponse) to the SP's Assertion Consumer Service (ACS) URL.
6. SP validates the signature using AM's public key from its metadata and creates a session.

Configuring a Service Provider in AM (IdP-side circle of trust):

• Obtain the SP's SAML2 metadata XML — contains entityID, ACS URL, signing certificates, and name ID formats.
• In AM console, navigate to the realm → Federation → Entity Providers → Import Entity. Paste or upload the metadata XML.
• Create or add to a Circle of Trust (CoT) that includes both the AM IdP entity and the imported SP entity.
• Configure the SP's attribute mapping — define which AM user attributes map to which SAML attributes in the assertion.
• Optionally configure the name ID format — persistent, transient, or email address.

For AM acting as SP (consuming assertions from an external IdP like Azure AD or Okta), the process is reversed — you import the IdP's metadata and configure how incoming assertions are mapped to AM session attributes.