Link identities in bulk
If you manage both the identity provider and service provider,
you can link accounts in bulk by using the
ssoadm bulk federation commands.
Before you can run the bulk federation commands, first establish the relationship between accounts,
set up the providers as described in Configure IDPs, SPs, and CoTs,
and install the
See Set up administration tools.
To understand the relationships between accounts,
consider an example where the identity provider is at
www.idp.com and the service provider is at
A demo user account has the Universal ID
id=demo,ou=user,dc=idp,dc=com on the identity provider.
That maps to the Universal ID
id=demo,ou=user,dc=sp,dc=com on the service provider.
ssoadm command requires a file that maps local user IDs to remote user IDs,
one per line, separated by the vertical bar (|) character.
Each line of the file appears as follows:
In the example, starting on the service provider side, the line for the demo user reads as follows:
All the user accounts mapped in your file must exist at the identity provider and the service provider when you run the commands to link them.
Link the accounts using the
ssoadm bulk federation commands:
Prepare the data with the
The following example starts on the service provider side:
$ cat /tmp/user-map.txt id=demo,ou=user,dc=sp,dc=com\|id=demo,ou=user,dc=idp,dc=com $ ssoadm do-bulk-federation \ --metaalias /sp \ --remoteentityid https://www.idp.com:8443/openam \ --useridmapping /tmp/user-map.txt \ --nameidmapping /tmp/name-map.txt \ --adminid uid=amAdmin,ou=People,dc=openam,dc=forgerock,dc=org \ --password-file /tmp/pwd.txt \ --spec saml2 Bulk Federation for this host was completed. To complete the federation, name Id mapping file should be loaded to remote provider.
Copy the name ID mapping output file to the other provider:
$ scp /tmp/name-map.txt email@example.com:/tmp/name-map.txt firstname.lastname@example.org’s password: ** name-map.txt 100% 177 0.2KB/s 00:00
Import the name ID mapping file with the
The following example is performed on the identity provider side:
$ ssoadm import-bulk-fed-data \ --adminid uid=amAdmin,ou=People,dc=openam,dc=forgerock,dc=org \ --password-file /tmp/pwd.txt \ --metaalias /idp \ --bulk-data-file /tmp/name-map.txt Bulk Federation for this host was completed.
At this point the accounts are linked.