feat(iam): saml

Author: ldecarvalho-doc

pages/iam/how-to/set-up-identity-federation.mdx

@@ -0,0 +1,82 @@
+---
+title: How to set up identity federation
+description: This page shows you how to set up identity federation on your Organization
+dates:
+  validation: 2025-09-21
+  posted: 2025-08-21
+---
+
+You can set up Identity Federation at Scaleway to ensure your [members can log in via Single Sign-On (SSO)]().
+
+At Scaleway we use Security Assertion Markup Language (SAML) to provide Identity Federation. You can link user identities across multiple independent systems and organizations to enable SSO across domains. You can manage your Scaleway identities via your Identity Provider of choice, as long as the provider supports SAML.
+
+<Requirements />
+
+- A Scaleway account logged into the [console](https://console.scaleway.com)
+- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
+
+## How to set up a SAML connection
+
+1. Go to your security settings.
+2. Scroll to the **Identity Federation** section.
+3. Click **Set up SSO**. A pop-up appears.
+4. Copy the URLs displayed in the pop-up.
+
+    The information in the first step are the URLs referring to Scaleway that will be requested by your Identity Provider to create a link between platforms. They are:
+        - The assertion consumer service (ACS) URL, and
+        - Scaleway's entity ID
+
+5. Click **Next**.
+6. Enter the requested URLs in their respective boxes.
+
+    This is the information referring to your Identity Provider that Scaleway needs to confirm the connection. They are:
+        - The Single Sign-On URL, and
+        - The Identity Provider's Entity ID
+7. Click **Confirm**.
+8. Enter the signing certificate generated by your Identity Provider in the box.
+    <Message type="important">
+      You can close the Identity Provider pop-up without adding the certificate right away. The certificate can [be added at a later time](#how-to-add-a-certificate). However, while the certificate is not added, the connection between Scaleway and your Identity Provider will not be complete and the SSO feature will not work for your Organization members.
+    </Message>
+9. Click **Complete setup**.
+
+## How to update the connection configuration
+
+If you change your Identity Provider, you will need to re-configure your SAML connection.
+
+1. Go to your security settings.
+2. Scroll to the **Identity Federation** section.
+3. Click **Edit configuration**. A pop-up appears.
+4. (Optional) Replace the Identity Provider's Single Sign-On URL and Entity ID with the information of your new one.
+5. Click **Confirm**.
+
+## How to add a certificate
+
+If you started the connection set up, but did not add a certificate right away, you can add it after. While the certificate is not added, the connection between Scaleway and your Identity Provider will not be complete and the SSO feature will not work for your Organization members.
+
+1. Go to your security settings.
+2. Scroll to the **Identity Federation** section.
+3. Click **+ Add certificate**. A pop-up appears.
+4. Enter the signing certificate generated by your Identity Provider in the box.
+5. Click **Confirm**.
+
+## How to renew a certificate
+
+You must regularly update your signing certificate in the frequency set by your Identity Provider. To renew a certificate:
+
+1. Go to your security settings.
+2. Scroll to the **Identity Federation** section.
+3. Click **Renew certificate**. A pop-up appears.
+4. Enter the signing certificate generated by your Identity Provider in the box.
+5. Click **Confirm**.
+
+## How to delete a connection
+
+1. Go to your security settings.
+2. Scroll to the **Identity Federation** section.
+3. Click **Delete SSO**.
+    <Message type="important">
+      A pop-up appears to warn you that:
+      - Deleting the connection will also delete your identity federation configuration and disable SAML-based SSO connections, preventing Members from logging in via this method. You can reconfigure identity federation at any time.
+    </Message>
+4. Type **DELETE** in the box to confirm.
+5. Click **Delete**.