> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/custom-integrations/ws-fed-application-integrations.md).
# WS-Fed Application Integrations
***
Web Services Federation (WS-Federation or WS-Fed) is an identity protocol that allows a Security Token Service (STS) in one trust domain to provide authentication information to a STS in another trust domain when there is a trust relationship between the two domains.
It is part of the larger WS-Security framework and an extension to the functionality of WS-Trust. WS-Fed features can be used directly by Simple Object Access Protocol (SOAP) applications and web services. This protocol that can be used to negotiate the issuance of a token. WS-Fed protocol supports both active and passive clients.
WS-Federation works in much the same way as SAML 2.0 and OpenID Connect. With WS-Federation, the requesting application is known as the Relying Party (RP) and the central service is known as the Security Token Service (STS).
### WS-Fed Integration
Our current SAML integration has been extended to support WS-Fed protocol.
### WS-Fed Configuration with Azure
* [AdminX Side](https://docs.1kosmos.com/productdocs/docs/app-integrations/ws-fed-application/#adminx-side)
* [Azure Side](https://docs.1kosmos.com/productdocs/docs/app-integrations/ws-fed-application/#azure-side)
#### AdminX Side
1. Navigate to your **AdminX** tenant.
2. Click the **Applications** icon on the left-hand menu.
3. Go to **Add Application** > **SAML 2.0 Generic** > **Add Integration** > **Add Application**.
4. Enter **Basic Settings** to create new SAML application:
* **Application Name**: ws-fed
* **Instance**: Production
* **Application access URL**:
5. Click **Next**.
6. Enter **Advanced Options**.
* **Entity ID**: `urn:federation:MicrosoftOnline`
* **Assertion Consumer Service**
* **Method**: POST
* **URL**:
* **Signing Algorithm**: RSA-SHA256
7. Click **Save**.
8. Enter **Assertion Statement (NameID)**. NameID should be mapped to an attribute which contains Azure user email.
* **Format**: `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`
* **Value**: lastname
* Add claim with name . Value should carry Azure user immutableID. This claim is required. All the other attributes and parameters are optional.
9. Click **Next**.
#### Azure Side
To federate Azure with AdminX, you need Windows PowerShell.
1. Download and install Windows PowerShell from .
2. Open Windows PowerShell and install the AzureAD module.
```
Install-Module -Name AzureAD
```
3. Import the AzureAD module into the PowerShell session.
```
Import-Module AzureAD
```
4. Install the MSOnline module.
```
Install-Module -Name MSOnline
```
5. Import the MSOnline module into the PowerShell session.
```
Import-Module -Name MSOnline
```
6. Connect to MSOnline; it will ask for credentials. Provide Azure administrator credentials.
```
Connect-MsolService
```
7. To remove previous federation from the domain, run this command with your domain name instead of 1kdemoengg.com.
```
Set-MsolDomainAuthentication -DomainName 1kdemoengg.com -Authentication Managed
```
8. Set a list of variables with IDP configuration. Login URL for WS-Fed will be `{tenantDNS}/adminapi/community/{communityName}/wsfed`.
```
$domainname = ""
$logoffuri = "" # Landing page when user logs out
$passivelogonuri = "" # Identity Provider SAML HTTP-POST endpoint
$cert = "" # Server certificate, pem file. Remove spaces and newlines
$issueruri = "" # Issuer URI set by your Identity Provider
$protocol = "WSFED" # To ensure domain uses SAML SSO
```
**Example values for 1k-dev**:
```
$domainname = “1kdemoengg.com”
$logoffuri = “https://1k-dev.1kosmos.net/adminapi/community/default/slo”
$passivelogonuri = “https://1k-dev.1kosmos.net/adminapi/community/default/wsfed”
$cert = “MIICnzCCAYegAwIBAgIJaZpHqX0MG1YgMA0GCSqGSIb3DQEBCwUAMA8xDTALBgNV
BAsTBHNhbWwwHhcNMjMwOTI5MTcxMjA3WhcNMjYwOTI4MTcxMjA3WjAPMQ0wCwYD
VQQLEwRzYW1sMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA00mFf9cn
6arhEB0o2VOH0bwXu1x2NUnLB6d7dCOywpHC8Kah4FcZTwyFnpYE4Y0+qhhPcSsD
eiQjNtiUz2nxkNmxX2+PZUVEf+f3EOHziBEwuV20kTZm02Q+8BCJijEySm8P7tSG
J15mbfwVUt89X26ENqypVrO4Ju9HTkFxctH5FCGIgm0wT5kkvRJuye1Q+aHFQHoV
RN8p7vpymTCiRIBGTBDptFdHFtldm2LQ4laqNC2pqxVW2bydBR77yVi7yFRsCO2h
xGb82mu5jZHulrvx53Vy0xGmeoCRRisB6DEbNDAWWgDtBZjqQR0u5QAnzSBSnKnl
vDYr6WLk52HBRwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA4zU2wXLYRlBZVW3St
WI+iyvONUpx1LKWbJnstSifUa/L3zVau+V1BOhQkYszUjUcmJZEFsWfqC7mejL3Z
QHzzoBNVka2zXxpoKFE+KNPhK9Qy7b5Ija7PKnyPgSfTI/6xnnJEyKCJ40kXEiqK
Oj+i2zyaISPCkN4Enyd60rZt37PBd5FnjCVTmHSpvqfRgHkwC84cQvJwKsSF2O6R
ncVyK11pn0Qc+Eh7mgUV9uzzq0gqv9qMmslWiKpQu2scktOalbckIRFjW0OpSLvn
Mu8Hr0/00J5aSkO3uTFTMTYTw5oB2JUEPtdf0RLTu/hysbbi4L/75KAyc9YVvGwQ
q+6h”
$issueruri = “urn:BlockID”
$protocol = “WsFed”
```
9. Run the next command to federate domain.
```
Set-MsolDomainAuthentication -DomainName $domainname
-FederationBrandName $domainname -Authentication
Federated -IssuerUri $issueruri -LogOffUri $logoffuri
-MetadataExchangeUri $passivelogonuri -PassiveLogOnUri
$passivelogonuri -ActiveLogOnUri $passivelogonuri -SigningCertificate
$cert -PreferredAuthenticationProtocol $protocol
```
10. To check if domain is federated.
```
Get-MsolDomain -Domainname $domainname
```
11. To get more information about a federated domain.
```
Get-MsolDomainFederationSettings -DomainName $domainname | Format-List
```
To log in with WS-Fed Azure AD, the user should set the ImmutableId property. To set the ImmutableId property, run the following command:
```
Set-MsolUser -UserPrincipalName -ImmutableId
```
**For example**:
```
Set-MsolUser -UserPrincipalName sasha@1kdemoengg.com -ImmutableId sasha@1kdemoengg.com
```
To check a user's ImmutableID.
```
Get-MsolUser -UserPrincipalName | select ImmutableID
```
**For example**:
```
Get-MsolUser -UserPrincipalName sasha@1kdemoengg.com | select ImmutableID
```
### Initiate Login
The steps to initiate login:
1. Navigate to the Azure portal login page.
2. Enter the user email from the federated domain.
3. The user should be redirected to the 1Kosmos login page.
4. Enter a valid user's credentials.
5. After the user is authenticated in 1Kosmos, the user will be redirected back to Azure and will be logged into the Azure portal.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.1kosmos.com/integrations/authentication/custom-integrations/ws-fed-application-integrations.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.