---
title: "Create an OIDC federation for AD FS"
sidebar_label: "Create an OIDC federation for AD FS"
sidebar_position: 2
description: "How to configure federation on the Selectel side and the AD FS identity provider side using the OIDC protocol"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import CreateFederationForSelectel from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/access-control/federations/manage-oidc/create-federation-for-selectel.mdx'

# Create an OIDC federation for AD FS

1. [Configure federation on the AD FS side](#configure-federation-for-identity-provider).
2. [Create a federation on the Selectel side](#create-federation-for-selectel).
3. [Add the Selectel federation ID to the AD FS federation](#add-selectel-federation-id-to-adfs).
4. If you enabled automatic user creation when creating the federation on the Selectel side, [configure user group mapping](#configure-mapping).

## 1. Configure federation on the AD FS side \{#configure-federation-for-identity-provider}

1. In the AD FS server, open **Server Manager**.

2. Right-click the **Application Group** section and select **Add Application Group**.

3. At the **Welcome** step:

   3.1. In the **Name** field, enter a federation name.

   3.2. In the **Templates** block, select the **Server application accessing a web** template.

   3.3. Click **Next**.

4. At the **Server application** step:

   4.1. Copy and save the value of the **Client Identifier** field.

   4.2. In the **Redirect URI** field, enter `https://api.selectel.ru/v1/auth/federations/oidc/`.

   4.3. Click **Next**.

5. At the **Configure Application Credentials** step:

   5.1. Select the **Generate shared secret** checkbox. A secret will be generated.

   5.2. Click **Copy to clipboard** and save the secret value. You will not be able to view it later.

   5.3. Click **Next**.

6. At the **Apply Access Control Policy** step:

   6.1. Select an access policy.

   6.2. Click **Next**.

7. At the **Configure Application Permissions** step:

   7.1. In the **Permitted scopes** block, select the **email**, **openid**, and **profile**.

   7.2. Click **Next**.

8. At the **Summary** step, click **Next**.

9. At the **Complete** step, click **Save**.

## 2. Create a federation on the Selectel side \{#create-federation-for-selectel}

<CreateFederationForSelectel IdIssuer="https://<idp_url>/adfs" ClientIdSpecify="сохранили из поля" ClientIdField="Client Identifier" ClientSecretGet="который вы получили при настройке федерации on этапе 1 in шаге 5.2" AuthUrl="https://<idp_url>/adfs/oauth2/authorize/" TokenUrl="https://<idp_url>/adfs/oauth2/token/" JwskUri="https://<idp_url>/adfs/discovery/keys" Step="4.1" />

## 3. Add the Selectel federation ID to the AD FS federation \{#add-selectel-federation-id-to-adfs}

1. In the AD FS server, open **Server Manager**.
2. In the **Application Group** section, open the federation you [configured on the AD FS side in step 1](#configure-federation-for-identity-provider).
3. In the **Redirect URI** field, enter `https://api.selectel.ru/v1/auth/federations/oidc/<federation_id>/callback`. Specify `<federation_id>` — the federation ID on the Selectel side. You can find it in the [Control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → **ID field**.
4. Click **Save**.

## 4. Configure user group mapping \{#configure-mapping}

Group mapping must be configured if you enabled automatic user creation during the [creation of a federation on the Selectel side at step 2](#create-federation-for-selectel). Use the [Configure group mapping](/access-control/groups/mapping.mdx#configure-group-mapping) subsection of the [User group mapping](/access-control/groups/mapping.mdx#configure-group-mapping) guide.

<Formbricks />