Applications
FoxIDs becomes an OpenID Provider (OP), Identity Provider (IdP), or Security Token Service (STS) by registering an application. Application registrations connect your applications and APIs to FoxIDs, select the allowed authentication methods, and define how tokens or assertions are issued.
External IdPs are connected with authentication methods. By combining a SAML 2.0 authentication method with an OpenID Connect application registration, FoxIDs can act as a bridge between SAML 2.0 and OpenID Connect.
Create an application registration
In FoxIDs Control, select the Applications tab and click Add application. Select the card that matches the application:
- Web Application for a server-based OpenID Connect confidential client.
- Single Page Application for a browser-based OpenID Connect public client.
- Native Application for an installed OpenID Connect public client.
The cards create suitable starting configurations. Enable Show all options to create a SAML 2.0 or WS-Federation web application, an OAuth 2.0 backend application, or an API. Quick-setup templates can also be available for specific integrations.
After creation, open the application and click Change application to review or change its complete configuration.
Application protocols
Application registrations support these protocol families:
- OpenID Connect application registration for web, single-page, and native applications.
- OAuth 2.0 application registration for APIs and backend clients.
- SAML 2.0 application registration for SAML service providers.
- WS-Federation application registration for WS-Federation relying parties.
JWT and SAML
OpenID Connect, OAuth 2.0, JWT, and JWT claims are first-class citizens in FoxIDs. Internally, claims are always represented as JWT claims, and request and response properties use OAuth 2.0 and OpenID Connect attributes.
FoxIDs converts between standards by normalising attributes into that internal representation. Therefore, SAML 2.0 and WS-Federation SAML claims are converted to JWT claims between the authentication method and the application registration.
Connect applications and APIs
When you register an application with OpenID Connect, SAML 2.0, or WS-Federation, FoxIDs becomes the OP, IdP, or STS for that application.
You most often connect applications and APIs, but an application registration can also issue tokens to an external system where that system is the relying party.
OpenID Connect and OAuth 2.0
It is recommended to secure applications and APIs with OpenID Connect and OAuth 2.0. See .NET Samples for end-to-end examples.
How-to guides:
- Connect Tailscale
SAML 2.0
Configure SAML 2.0 to act as an Identity Provider.
How-to guides:
- Connect AD FS
- Connect Amazon IAM Identity Center
- Connect Google Workspace
- Connect Microsoft Entra ID
- Connect Context Handler test IdP (Danish identity broker)
WS-Federation
Configure WS-Federation to act as a Security Token Service.
Common relying parties include Microsoft Entra ID domain federation and federated Windows sign-in, AD FS relying party trusts, SharePoint, Dynamics, older ASP.NET WS-Federation middleware, and generic WS-Federation applications.
How-to guides:
Sample applications and APIs
FoxIDs cloud is configured with the test tenant test-corp. The tenant is configured with application registrations for the sample apps and APIs.
- Sign in to the
test-corptenant in FoxIDs Control with the reader email address and password shown on the sign-in page to inspect the sample configuration. - Open the OpenID Connect sample to test user sign-in, inspect claims, and call protected APIs.
- Test token exchange flows in the online sample after sign-in, or see the token exchange docs.
- Review .NET Samples for local sample setup, sample categories, and direct links to the sample source code.