> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/custom-integrations/ws-fed-application-integrations.md).
# WS-Fed Application Integrations
WS-Fed (WS-Federation) Application Integration is a way to enable Single Sign-On (SSO) between an Identity Provider (IdP) and an application using the WS-Federation protocol.
***
Web Services Federation (WS-Federation or WS-Fed) is an identity protocol that allows a Security Token Service (STS) in one trust domain to provide authentication information to a STS in another trust domain when there is a trust relationship between the two domains.
It is part of the larger WS-Security framework and an extension to the functionality of WS-Trust. WS-Fed features can be used directly by Simple Object Access Protocol (SOAP) applications and web services. This protocol that can be used to negotiate the issuance of a token. WS-Fed protocol supports both active and passive clients.
WS-Federation works in much the same way as SAML 2.0 and OpenID Connect. With WS-Federation, the requesting application is known as the Relying Party (RP) and the central service is known as the Security Token Service (STS).
### WS-Fed Integration
Our current SAML integration has been extended to support WS-Fed protocol.
### WS-Fed Configuration with Azure
* [AdminX Side](https://docs.1kosmos.com/productdocs/docs/app-integrations/ws-fed-application/#adminx-side)
* [Azure Side](https://docs.1kosmos.com/productdocs/docs/app-integrations/ws-fed-application/#azure-side)
#### AdminX Side
1. Navigate to your **AdminX** tenant.
2. Click the **Applications** icon on the left-hand menu.
3. Go to **Add Application** > **SAML 2.0 Generic** > **Add Integration** > **Add Application**.
4. Enter **Basic Settings** to create new SAML application:
* **Application Name**: ws-fed
* **Instance**: Production
* **Application access URL**:
5. Click **Next**.
6. Enter **Advanced Options**.
* **Entity ID**: `urn:federation:MicrosoftOnline`
* **Assertion Consumer Service**
* **Method**: POST
* **URL**:
* **Signing Algorithm**: RSA-SHA256
7. Click **Save**.
8. Enter **Assertion Statement (NameID)**. NameID should be mapped to an attribute which contains Azure user email.
* **Format**: `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`
* **Value**: lastname
* Add claim with name . Value should carry Azure user immutableID. This claim is required. All the other attributes and parameters are optional.
9. Click **Next**.
#### Azure Side
Federate a Microsoft Entra ID custom domain with 1Kosmos as the SAML identity provider using the Microsoft Graph PowerShell SDK.
{% hint style="info" %}
The legacy **MSOnline** and **AzureAD** PowerShell modules are deprecated. This section uses the current **Microsoft Graph PowerShell SDK**.
{% endhint %}
**Prerequisites**
* Global Administrator permissions in Microsoft Entra ID
* A verified custom domain in Microsoft Entra ID
* 1Kosmos BlockID SAML configuration details (see below)
**Required Information from 1Kosmos**
```
1Kosmos Platform details
- Issuer URI: [Entity ID from your community]
- SSO URL: [SSO URL from your community]
- SLO URL: [SLO URL from your community]
- Signing Certificate: [Base64 encoded certificate]
```
**Step 1: Launch the Microsoft Graph PowerShell**
1.1. Log in to [portal.azure.com](https://portal.azure.com).
1.2 In the header, click  (Cloud Shell icon). A **Cloud Shell** toolbar appears as shown below; Select **PowerShell**.
1.3. Once PowerShell is launched, run the command below.
```powershell
Install-Module Microsoft.Graph -Scope CurrentUser
```
**Step 2: Connect to Microsoft Graph**
Connect with the permissions required to manage domains.
```powershell
Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.ReadWrite.All"
```
**Step 3: Verify Domain Status**
Confirm the domain's current authentication type is `Managed` before you federate it.
```powershell
Get-MgDomain -DomainId "EntraID domain name"
```
**Step 4: Configure Domain Federation**
Define the federation parameters, then apply them.
```powershell
$federationParams = @{
DomainId = "EntraID domain name"
DisplayName = "1Kosmos"
IssuerUri = "urn:entityID"
metadataexchangeuri = "[tenantdns/communityname/services/trust/mex]"
PassiveSignInUri = "[tenantdns/adminapi/communityname/wsfed]"
SignOutUri = "[tenantdns/adminapi/communityname/slo]"
SigningCertificate = "[Base64 encoded certificate]"
PreferredAuthenticationProtocol = "wsFed"
FederatedIdpMfaBehavior = "acceptIfMfaDoneByFederatedIdp"
}
New-MgDomainFederationConfiguration @federationParams
```
**Step 5: Verify Federation**
Confirm the domain is now federated and review the applied configuration.
```powershell
# Domain should now show AuthenticationType: "Federated"
Get-MgDomain -DomainId "EntraID domain name"
# Review the federation configuration details
Get-MgDomainFederationConfiguration -DomainId "EntraID domain name"
```
**Step 6: Test Federation**
1. Navigate to .
2. Enter any user with the Entra ID domain name.
The sign-in should redirect to 1Kosmos authentication.
**Revert Federation (if needed)**
Roll the domain back to a managed (cloud-only) configuration.
```powershell
# Get the federation configuration
$federationConfig = Get-MgDomainFederationConfiguration -DomainId "EntraID domain name"
# Remove the federation
Remove-MgDomainFederationConfiguration -DomainId "EntraID domain name" -InternalDomainFederationId $federationConfig.Id
# Domain should return to AuthenticationType: "Managed"
Get-MgDomain -DomainId "EntraID domain name"
```
### Initiate Login
The steps to initiate login:
1. Navigate to the Azure portal login page.
2. Enter the user email from the federated domain.
3. The user should be redirected to the 1Kosmos login page.
4. Enter a valid user's credentials.
5. After the user is authenticated in 1Kosmos, the user will be redirected back to Azure and will be logged into the Azure portal.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.1kosmos.com/integrations/authentication/custom-integrations/ws-fed-application-integrations.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
