Table of Contents
Identity Provider
22. August 2025
Table of Contents
Instead of using only the Fotoware Alto IDS, you can connect an OpenID Provider, which will serve as an Identity Provider to the Fotoware Alto IDS. The selected Identity Provider (IdP) must support the standardized Open ID Connect protocol, which allows a flexible implementation that varies in required metadata or ACR values.
Choose Identity Provider
The user opens Fotoware Alto by providing the URL. They choose to log in with Fotoware Alto IDS credentials by providing an email and password (1). This will authenticate the user with Fotoware Alto IDS as Identity Provider. If configured, they can also choose another external identity provider (2) that will handle the authentication.
In the Customer Default Settings, you can set the accent color for the IdP.
Create Identity Provider
You can configure one or many external Identity Providers for authentication.
Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g. user attributes). Identity providers offer user authentication as a service. Fotoware Alto outsources the user authentication to the Fotoware Alto Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.
Whenever Office 365 needs to verify a user, for example, Azure AD performs all identity and access management and is thus the trusted identity provider.
Prerequisites
- ADFS setup (See How To setup ADFS on Windows Server 2016 here)
- Your user must have Developer permission in the Fotoware Alto configuration to see this menu.
- Your user role must have permission to manage Identity Provider.
Setup
Adding an external Identity Provider in Fotoware Alto means adding it to theFotoware Alto IDS.
- Go to Settings > IdP setup.
- In the list, choose Create new identity provider.
- Enter the details.
- Save.
Newly created IdP's or changes made to existing ones could take around a minute to take effect.
Settings
| Setting | Value Example | Description |
| Name | FotowareAltoADFSWinServer2016 | A meaningful name that is used as a reference, it cannot be changed afterward. |
| Display name | Fotoware Alto AD |
Something users can relate to, which is shown to the users next to "Continue with"
|
| Type | ADFS |
|
| Connection protocol | OpenID Connect | IdP must support OpenID Connect. |
| URL | https://ad.customer.ch/adfs |
Do not use the /ls endpoint. If your ADFS URL is https://adfs02.domain.com/adfs/ls then use the URL without /ls: https://adfs5684.domain.com/adfs. |
| Client ID | Application ID e.g. 9df5684-1f10f-4125684-7feb535684 |
The ID of your application:
|
| Client secret | GBAyfVL7YWtP6gudLIjbRZV_N0dW4f3x ETiIxqtokEAZ6FAsBtgyIq0MpU1uQ7J0 8xOTO2zwP0OuO3pMVAUTid |
This is not needed. You can leave this empty. The authentication flow is the definition of how the tokens to identify users are exchanged. Fotoware Alto external Identity Provider must support Authorization Code Flow with PKCE. PKCE, pronounced “pixy” is an acronym for Proof Key for Code Exchange, which does not require users to provide a client_secret. The standard Authorization Code flow would require this. The main benefit is the reduced risk for native apps, as there are no embedded secrets in the source code and this in return limits exposure to reverse engineering. If the Identity Provider does not support Authorization Code Flow with PKCE, the Client secret can be used. Then the client secret must match the applications client secret. |
| Sort order | 0 | A number, starting from 0 for the first position, and 1 as the second position. |
After creating the Identity Provider
Create Identity Provider (Claim) Mappings
You can configure claim mappings and group mappings for your external Identity Provider.
Identity providers (short: IdP, IDP) are systems that manage and maintain identity information (e.g. user attributes). Identity providers offer user authentication as a service. Fotoware Alto outsources the user authentication to theFotoware Alto Identity Server as the default trusted identity provider and is thus a relying party application to it. See Wikipedia Identity Provider.
Whenever Office 365 needs to verify a user, for example, Azure AD performs all identity and access management and is thus the trusted identity provider.
Prerequisites
Create claim mappings
- Go to Settings > IdP Settings.
- You will see a setting entry for your new Identity Provider in the list. Double-click to open it.
- On the right side, in the first tab, you can add the claim mapping:
- Add claim mapping.
- Provide the claim name from your AD, which holds the user attributes e.g., company, telephone number. Ensure the correct spelling!
- Map to Fotoware Alto user attributes.
On the right side in the second tab, you can add the group mapping:
- Add group mappings.
- Provide the claim name (issued claims) from your AD, which holds your user group assignments, e.g., Groups. Ensure the spelling is correct!
- Define a Fallback user role. The fallback user role of the IdP will only be used if none of the group mappings find a matching role or the default user role is not defined for Fotoware Alto. This cannot be Super Admins.
- Map Group names from your AD to user roles in Fotoware Alto.
- Provide the claim name (issued claims) from your AD, which holds your user group assignments, e.g., Groups. Ensure the spelling is correct!
Without group mappings your users will be able to login to Fotoware Alto but will either have only the default role or fallback user role of your Fotoware Alto assigned (if these are configured), or will not have any access. Be aware that you can also manually add roles to federated users in Fotoware Alto.
There is a Microsoft limitation for ADFS 2.0 which prevents using Domain Local Groups in a claim. Choose global or universal groups. More details on this limitation: https://social.technet.microsoft.com/wiki/contents/articles/13829.ad-fs-2-0-domain-local-groups-in-a-claim.aspx
Automatic Claim Mappings
The following attributes are mapped automatically in Fotoware Alto (if not overridden by a claim mapping).
Further information about claims here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims
| User attribute | Claim types (first to have a value wins) |
| email, that will be used as a username inFotoware Alto (mandatory). | |
| sub | User identifier of the user within the IdP (mandatory; provided by ADFS in basic configuration). |
| First name | given_name |
| Last name | family_name |
| Language code |
|
After creating Identity Provider mappings
Update Identity Provider
- Go to Settings > IdP setup.
- Select your Identity Provider from the list.
- Edit the details.
- You cannot update the name, only the display name.
- Save.
Newly created IdP's or changes made to existing ones could take around a minute to take effect.
Effects of updating Identity Provider
- Users cannot log in when their assigned Identity Provider is disabled.
- The display name will be updated on the login screen.
- The protocol cannot be changed.
- If you change the URL, your users' login requests will, from now on, be sent to the new URL.
- If you change the client ID, your users' login requests will, from now on, contain the new client ID, so you must ensure to have a working IdP with this client ID available.
- Changes to the Client secret have no effect if authorization code flow with PKCE is used; otherwise, the client secret must match with the application.
- Changing the sort order will change the sort order of the buttons on the login form, where 0 is the first position.
Delete Identity Provider
- Go to Settings > IdP setup.
- In the list, delete your Identity Provider.
Before deleting Identity Provider
- Open Users.
- Switch Search Mode to Advanced.
- Search for all users which have the Identity Provider assigned
identityProviderId:<id> - Update those users, as otherwise, they can no longer log in to Fotoware Alto.
Effects of deleting Identity Provider
- The users who were using this Identity Provider can no longer log in.
- No default or fallback Identity Provider will be assigned.
Purge Identity Provider
- Go to Settings > IdP setup.
- Select your Identity Provider from the list.
- Select Purge.
- In the confirmation dialog, select Purge.
Effects of purging Identity Provider
- Claims of all users will be purged.
- Users must login again and claims will be updated with the latest information of the IdP.
Setup Solutions
How To: Configure ADFS on Windows Server 2016 — The installation and configuration of the ADFS service are on the sole behalf of the customers and not Fotoware Alto related. Before configuring the Identity Provider in Fotoware Alto, ADFS must be properly installed and configured.
How To: Integrate Azure Active Directory with Fotoware Alto —
This tutorial teaches you how to integrate Content Platform with Microsoft Entra ID (formerly Azure Active Directory).