Breadcrumbs

Enabling federations

By editing the Keystone connection for an application (from Keystone settings > Keystone connections or through a link at the top of the application page), you can configure the federations of which Keystone is aware.

At the bottom of a Keystone connection page, find the ways in which you can connect identity providers to your application(s). There are three sections:

  • OpenAthens Federation: our own federation

  • Other Federations: standard federations around the world

  • 1:1 Connections: connections to individual IdPs that are not in a federation, or with which you don’t share a federation. See Entities that are not in a federation for how to configure these connections

Edit the settings and save your changes to make the data available to Keystone.

Editing your federation settings here does not add you to those federations - that is a function of the federation operators. See How to join other federations.

Lower part of the connection details page. There are several options that can each be set to 'on' or 'off' - 'Allow sign-in for OpenAthens Test identity providers' 'Allow sign-in for live OpenAthens identity providers', and a list of 'other federations' identified by name.

Add a federation

  1. Go to Keystone settings > Keystone connections.

    Main Keystone connections page. Intro text reads 'A Keystone connection contains the configuration details for managing federated and bilateral access to your OpenID Connect applications.' This is followed by more specific help text and then a list of existing connections, each shown with its basic details. Beside each connection is a drop-down list labeled 'Options'. There is also a drop-down menu labeled 'Sort by'.

  2. Select the required connection from the list to edit it.

    Details tab of a connection called 'Philosophy Today connection'. The top part of this long page is visible, showing the sections 'Application' and 'Rules'. In the top right corner is a 'Save changes' button.

  3. Scroll down the page to the sections beginning OpenAthens Federation.

  4. Under OpenAthens Federation, switch on Allow sign-in for OpenAthens Test identity providers to allow access through OpenAthens for testing. Switch on Allow sign-in for live OpenAthens identity providers when the application is ready to go live.

    Subsection of the Details tab headed 'OpenAthens Federation. It has two settings, 'Allow sign-in for OpenAthens Test identity providers' and 'Allow sign-in for live OpenAthens identity providers'. Beside each setting is a switch that can be set to 'On' or 'Off'.

  5. Under Other Federations, switch on any other federations to which you belong or that you plan to join.

    Subsection of the Details tab headed 'Other Federations'. It shows a list of three federations, in alphabetical order, followed by a 'Show all' button. Beside the name of each federation is a switch that can be toggled 'On' or 'Off'.

  6. Press Save changes at the top right.

After saving your changes

  • If you added new federations, you still need to go through those federations' membership processes to join them. See How to join other federations

Statuses and errors

Some federations may be shown with a status badge, such as Info or Error.

Subsection of a connection's Details tab, headed 'OpenAthens Federation'. There are two settings, 'Allow sign-in for OpenAthens Test identity providers' (which is turned off) and 'Allow sign-in for live OpenAthens identity providers' (which is on). Beside the latter setting is an 'Info' badge.

To learn more about a status, hover over the badge. You’ll see further information in a tooltip.

Tooltip displayed above the 'Info' badge. It reads, 'Information about the connection registration. This connection is being tested by the OpenAthens team. We will publish it in the federation when it has passed testing.'

The system performs a basic error check that flags differences between the local and remote metadata. Unimportant differences, such as formatting in a metadata file, can occasionally produce incorrect Error statuses.