The user opens Fotoware Alto by providing the URL. They choose to log in with Fotoware Alto IDS credentials by providing an email and password (1). This will authenticate the user with Fotoware Alto IDS as the Identity Provider. If configured, they can also choose another external identity provider (2) to handle authentication. 

In the Customer default settings, you can set the accent color for the IdP.

You can configure one or many external Identity Providers for authentication. 

Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g., user attributes). Identity providers offer user authentication as a service. Fotoware Alto outsources the user authentication to the Fotoware Alto Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.

Whenever Office 365 needs to verify a user, for example, Azure AD performs all identity and access management and is thus the trusted identity provider. 

Prerequisites

• ADFS setup - see How to set up ADFS on Windows Server 2016
• Your user must have Developer permission in the Fotoware Alto configuration to see this menu.
• Your user role must have permission to manage the Identity Provider.

Setup

Adding an external Identity Provider in Fotoware Alto means adding it to the Fotoware Alto IDS. 

1. Go to Settings > IdP setup.
2. In the list, choose Create new identity provider.
3. Enter the details.
4. Save.

Settings

Setting	Value Example	Description
Name	FotowareAltoADFSWinServer2016	A meaningful name used as a reference cannot be changed afterward.
Display name	Fotoware Alto AD	Something users can relate to, shown to users next to Continue with.
Type	ADFS	ADFS is currently supported in Fotoware Alto.  Azure AD is currently supported in Fotoware Alto. Others planned to support, but currently not in use.
Connection protocol	OpenID Connect	IdP must support OpenID Connect.
URL	https://ad.customer.ch/adfs	The Endpoint for OpenID with https.  For ADFS, something like https://ad.customer.com/adfs. Check this with your IT department.  For other identity providers, it is the Open ID Connect configuration, e.g. https://login.microsoftonline.com/99292bdd-6686-4f0b-817b-f8e8571cf07c/v2.0/.well-know/openid-configuration (Remove everything after the version number of the open id config URL) Do not use the /ls endpoint. If your ADFS URL is https://adfs02.domain.com/adfs/ls then use the URL without /ls:  https://adfs5684.domain.com/adfs.
Client ID	Application ID, e.g., defines how user identification tokens  9df5684-1f10f-4125684-7feb535684	The ID of your application:
Client secret	GBAyfVL7YWtP6gudLIjbRZV_N0dW4f3x ETiIxqtokEAZ6FAsBtgyIq0MpU1uQ7J0 8xOTO2zwP0OuO3pMVAUTid	This is not needed. You can leave this empty.  The authentication flow defines how user identification tokens are exchanged. Fotoware Alto external Identity Provider must support Authorization Code Flow with PKCE. PKCE, pronounced "pixy", is an acronym for Proof Key for Code Exchange, which does not require users to provide a client_secret. The standard Authorization Code flow would require this. The main benefit is reduced risk for native apps, as there are no embedded secrets in the source code, thereby limiting exposure to reverse engineering.  If the Identity Provider does not support Authorization Code Flow with PKCE, the Client secret can be used. Then the client secret must match the application's client secret.
Sort order	0	A number, starting from 0 for the first position, and 1 for the second position.

After creating the Identity Provider

1. Add claim mappings
2. Add group mappings
3. Add Identity Provider to users

You can configure claim mappings and group mappings for your external Identity Provider. 

Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g., user attributes). Identity providers offer user authentication as a service. Fotoware Alto outsources the user authentication to the Fotoware Alto Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.

Whenever Office 365 needs to verify a user, for example, Azure AD performs all identity and access management and is thus the trusted identity provider. 

Prerequisites

• Identity Provider set up

Create claim mappings

1. Go to Settings > IdP Settings.
2. You will see a setting entry for your new Identity Provider in the list. Double-click to open it.
3. On the right side, in the first tab, you can add the claim mapping:
   1. Add claim mapping.
   2. Provide the claim name from your AD that holds the user attributes, e.g., company and telephone number. Ensure the correct spelling! 
   3. Map to Fotoware Alto user attributes.
       

On the right side in the second tab, you can add the group mapping:

1. Add group mappings.
   1. Provide the claim name (issued claims) from your AD, which holds your user group assignments, e.g., Groups. Ensure the spelling is correct.
      
   2. Define a Fallback user role. The IdP's fallback user role will only be used if none of the group mappings match a role. Without group mappings, your users will be able to log in to Fotoware Alto, but will either have only the default role or the fallback user role of your Fotoware Alto assigned (if these are configured), or will not have any access. The default user role is not defined for Fotoware Alto. This cannot be Super Admins. 
   3. Map Group names from your AD to user roles in Fotoware Alto.
       

Automatic Claim Mappings

The following attributes are automatically mapped in Fotoware Alto (unless overridden by a claim mapping). 

Further information about claims here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims

After creating Identity Provider mappings

Add Identity Provider to users

1. Go to Settings > IdP setup.
2. Select your Identity Provider from the list.
3. Edit the details.
   1. You cannot update the name, only the display name.
4. Save.

Effects of updating Identity Provider

• Users cannot log in when their assigned Identity Provider is disabled.
• The display name will be updated on the login screen. 
• The protocol cannot be changed. 
• If you change the URL, your users' login requests will be sent to the new URL from now on. 
• If you change the client ID, your users' login requests will, from now on, include the new client ID, so you must ensure that a working IdP with this client ID is available. 
• Changes to the Client secret have no effect if the authorization code flow with PKCE is used; otherwise, the client secret must match the application.
• Changing the sort order changes the order of the buttons on the login form, with 0 being the first position.

1. Go to Settings > IdP setup.
2. In the list, delete your Identity Provider.

Before deleting the Identity Provider

1. Open Users.
2. Switch Search Mode to Advanced.
3. Search for all users who have the Identity Provider assigned
   identityProviderId:<id> 
4. Update those users, as otherwise, they can no longer log in to Fotoware Alto.

Effects of deleting the Identity Provider

• The users who were using this Identity Provider can no longer log in. 
• No default or fallback Identity Provider will be assigned. 

1. Go to Settings > IdP setup.
2. Select your Identity Provider from the list.
3. Select Purge.
4. In the confirmation dialog, select Purge.

Effects of purging the Identity Provider

• All users' claims will be purged.
• Users must log in again, and claims will be updated with the latest information from the IdP. Users must log in again, and claims will be updated with the latest information from the IdP.