---
title: Set up identity federation
description: This page shows you how to set up identity federation on your Organization
dates:
validation: 2025-11-24
posted: 2025-08-21
---
import Requirements from '@macros/iam/requirements.mdx'
Scaleway supports Identity Federation to provide your teams with secure access to their accounts via Single Sign-On (SSO). Depending on your organization’s requirements, you can use either built-in OAuth2 providers or configure SAML for centralized identity management.
| Feature | **OAuth2** | **SAML** |
|--------|-------------------------------|--------|
| **Availability** | Enabled by default for all organizations | Available, but requires setup |
| **Supported Providers** | Google, GitHub | Any SAML-compatible Identity Provider |
| **Setup Required** | No | Yes — must be configured by an IAM admin |
| **User Access** | Any Scaleway member whose email is verified with Google or GitHub | Only users explicitly defined in the Identity Provider |
| **Centralized Management** | No | Yes — manage users from your Identity Provider |
Keep in mind that:
- Each authentication method (SAML SSO, OAuth2 SSO, authentication code, password) can be enabled or disabled inside the Organization. Members can only authenticate using methods that an IAM admin has enabled.
- SSO with SAML does not apply to an Organization's Owner. Owners can log in with SSO with OAuth2.
Follow the steps below to set up Identity Federation for your Organization through SAML at Scaleway.
- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- An Identity Provider (IdP) configured in your company, making sure it includes all users who need to access Scaleway. Some examples of IdPs:
- Okta
- OneLogin
- Microsoft Entra ID (prev. Azure AD)
- PingIdentity
- Google Workspace
- Authentik
## Set up a SAML connection
1. Go to your security settings.
2. Scroll to the **Configure Identity Federation** section.
3. Click **Set up SAML SSO**. A pop-up appears.
4. Copy the URLs displayed in the pop-up.
The information in the first step are the URLs referring to Scaleway that will be requested by your Identity Provider to create a link between platforms. They are:
- The assertion consumer service (ACS) URL, and
- Scaleway's entity ID
5. Click **Import identity provider data**.
6. Upload your identity provider metadata. Most identity providers supply an XML file export of your configuration. You can upload this file to automatically set up SAML.
Alternatively, you can click **Set up manually** to manually enter the IdP's metadata. This is the information referring to your Identity Provider that Scaleway needs to confirm the connection. It can be found in your IdP's configuration page. The metadata includes:
- **Single Sign-On URL** - This is the URL your members will be redirected to when logging in with SAML
- **The Identity Provider's Entity ID**
7. Click **Submit**.
8. Enter the signing certificate generated by your Identity Provider in the box.
Keep in mind that:
- Only base64-encoded certificates are supported.
- The certificate must have an expiration date.
- Your certificate entry must start with:
```
-----BEGIN CERTIFICATE-----
```
And end with:
```
-----END CERTIFICATE-----
```
You can close the Identity Provider pop-up without adding the certificate right away. The certificate can [be added at a later time](#how-to-add-a-certificate). However, while the certificate is not added, the connection between Scaleway and your Identity Provider will not be complete and the SSO feature will not work for your Organization members.
9. Click **Complete set up**.
Once setup is complete, members can log in via SAML.
You can test the connection by creating a member and logging in with the new member account.
Keep in mind that:
- User mapping between Scaleway and the Identity Provider must be done on the username. When testing the connection, if an error persists about the user not existing in Scaleway, make sure your Identity Provider is mapping the user on their username.
- Members need to already have been [created manually](/iam/how-to/manage-members/#how-to-create-a-member) in Scaleway to log in.
- If you delete a user in the IdP, the corresponding Member is not automatically deleted in your Scaleway Organization. The [deletion must happen manually](/iam/how-to/manage-members/#how-to-delete-a-member).
## Map user attributes
Scaleway matches Members using their username, received as the SAML `NameID` value, not their email address. Incorrect attribute mapping in the Identity Provider is a common cause of connection failures, where the Member cannot be found in Scaleway.
The value sent as the SAML `NameID` must correspond to the username of the Member in Scaleway, not their email address, unless the two values happen to be identical. If a connection test fails with an error about the user not existing in Scaleway, check the attribute mapping in the Identity Provider first.
### Google Workspace
On the **Attribute mapping** page of the Scaleway SAML app in Google Workspace, no additional mapping is generally required for SSO to work. Check that the following attributes are mapped as specified:
- Google Directory attribute: `Primary email` attribute under **Basic Information**
- SAML App attribute: `Username`
This mapping is often set by default. Click **Finish** to complete the app setup in Google Workspace.
Despite its name, the `Primary email` attribute is mapped to the `Username` SAML attribute, not to `NameID`. Do not create a separate mapping to `NameID`.
### Other identity providers
The mapping screen and terminology differ between providers, but the underlying rule stays the same: the attribute sent as `NameID` (or Subject) must contain the Scaleway username of the Member.
- For a full walkthrough with Authentik, see [How to set up SSO with Authentik](/iam/how-to/set-up-sso-with-authentik/), which maps the `NameID` property to `Username`.
- For Okta, Microsoft Entra ID, OneLogin, or other providers, locate the `NameID` (or Subject) configuration of the SAML application, and map it to the attribute holding the username rather than the email address.
## Update the connection configuration
If you change your Identity Provider, you will need to re-configure your SAML connection.
1. Go to your security settings.
2. Scroll to the **Identity Federation** section.
3. Click **Edit configuration**. A pop-up appears.
4. (Optional) Replace the Identity Provider's Single Sign-On URL and Entity ID with the information of your new one.
5. Click **Confirm**.
## Add a certificate
If you started the connection set up, but did not add a certificate right away, you can add it after. While the certificate is not added, the connection between Scaleway and your Identity Provider will not be complete and the SSO feature will not work for your Organization members.
1. Go to your security settings.
2. Scroll to the **Identity Federation** section.
3. Click **+ Add certificate**. A pop-up appears.
4. Enter the signing certificate generated by your Identity Provider in the box.
5. Click **Confirm**.
## Renew a certificate
You must regularly update your signing certificate in the frequency set by your Identity Provider. To renew a certificate:
1. Go to your security settings.
2. Scroll to the **Identity Federation** section.
3. Click **Renew certificate**. A pop-up appears.
4. Enter the signing certificate generated by your Identity Provider in the box.
5. Click **Confirm**.
## Delete a connection
1. Go to your security settings.
2. Scroll to the **Identity Federation** section.
3. Click **Delete SSO**.
A pop-up appears to warn you that:
- Deleting the connection will also delete your identity federation configuration and disable SAML-based SSO connections, preventing Members from logging in via this method. You can reconfigure identity federation at any time.
4. Type **DELETE** in the box to confirm.
5. Click **Delete**.