Integrations

EduGAIN is a federated academic identity service connecting research and education institutions worldwide. Waldur supports full integration as an EduGAIN Service Provider, including CoCo extensions for higher security guarantees. Users authenticate via their home organization credentials while maintaining federated identity attributes.

KeyCloak is an open-source identity and access management server. Waldur synchronizes marketplace user roles with Keycloak groups, supporting offering-wide and resource-level scoping of roles. It auto-syncs marketplace memberships with Keycloak, maintains hierarchical group structures, and supports customizable group naming templates.

Waldur supports taking user identities from an external LDAP-server, such as FreeIPA, OpenLDAP or Active Directory. Simple configuration for LDAP schema allows connecting existing user profiles with Waldur for authentication. This enables organizations to use their existing directory infrastructure as the identity source for Waldur.

MyAccessID is GEANT’s identity service for research infrastructures. Waldur integrates with MyAccessID enabling Infrastructure Service Domains to push user attributes with per-attribute source tracking across multiple domains. It supports multi-ISD lifecycle management ensuring user data integrity when one domain’s access is revoked while others remain active.

Waldur supports federated identity providers over SAML 2.0 protocols with configurable identity providers and attribute mapping. It enables Single Sign-On authentication with signed requests, encrypted assertions, and metadata exchange. Automated account creation and updates are driven by information from SAML attributes during authentication flows.

Waldur provides built-in user profile management within its local database, requiring no additional identity infrastructure. Profile fields can be tuned to match deployment specifics, including support for additional names in national languages. This is the simplest identity option, suitable for standalone deployments without external identity providers.