Authentication nodes

Write Federation Information node

The Write Federation Information node creates a persistent link between a remote IdP account and a local account in the SP, if none exists yet. If a transient link exists, it’s persisted. Existing account links with different IdPs aren’t lost.

Use this node with the SAML2 Authentication node, and ensure that the NameID Format is persistent.

Example

You can find examples that show this node in a SAML 2.0 authentication journey in SSO in integrated mode.

Availability

Product Available?

PingOne Advanced Identity Cloud

Yes

PingAM (self-managed)

Yes

Ping Identity Platform (self-managed)

Yes

Inputs

The node requires the userInfo shared state property from a preceding SAML2 Authentication node. The property must contain the configured persistent NameID attribute.

Dependencies

  • Use the node in a SAML 2.0 authentication journey.

  • Configure the SAML 2.0 federation to use the persistent NameID Format.

Configuration

This node has no configurable properties.

Outputs

The node persists the link between the remote IdP account identified by the NameID and the local SP account.

Callbacks

This node doesn’t send any callbacks.

Outcomes

Single outcome path.

Errors

The node can log the following errors:

  • No user information has been found in the shared state.

    A preceding node didn’t set the userInfo shared state property.

  • <NameID information attribute> is not defined in shared state.

    The userInfo property doesn’t contain the NameID information attribute.

  • Unable to link accounts

    The node couldn’t persist the account link. Check the SAML 2.0 configuration and the local user identity.